LOWBALL
LOWBALL is a backdoor used by the admin@338 threat group. It uses the legitimate Dropbox cloud storage service for command and control via the Dropbox API with a hardcoded bearer access token, communicating over HTTPS on port 443. LOWBALL can download, upload, and execute files. In observed activity, it was delivered through spear-phishing emails containing Microsoft Word attachments exploiting CVE-2012-0158; three cited lure documents delivered the same payload, time.exe (MD5: d76261ba3b624933a6ebb5dd73758db4). After execution, LOWBALL attempted to retrieve files named WmiApCom (MD5: d76261ba3b624933a6ebb5dd73758db4) and WmiApCom.bat (MD5: 79b68cdd0044edd4fbf8067b22878644) from Dropbox, likely as an update mechanism, with WmiApCom.bat used to start WmiApCom. Operators monitored the Dropbox account for victim callbacks, then created a batch file named [COMPUTER_NAME]_upload.bat containing commands for the compromised host to execute; results were uploaded back as [COMPUTER_NAME]_download. Observed post-compromise reconnaissance commands included ver and systeminfo for OS information, net start for services, dir for files and directories, net user and net user /domain for account enumeration, net localgroup administrator for local group information, netstat -ano for network connections, and ipconfig /all for local network configuration, with output redirected to %temp%\download. The collected information was used to decide whether to continue operations or deploy additional malware. In at least one case, operators staged the second-stage backdoor BUBBLEWRAP (Backdoor.APT.FakeWinHTTPHelper) via Dropbox; an observed command renamed %temp%\upload to audiodg.exe and executed it. Related indicators mentioned in the content include malicious document MD5s b9208a5b0504cb2283b1144fc455eaaa, ec19ed7cddf92984906325da59f75351, and 6495b384748188188d09e9d5a0c401a4, as well as BUBBLEWRAP C2 domain accounts.serveftp[.]com resolving to 59.188.0.197. The campaign described targeted recipients reading traditional Chinese commonly used in Hong Kong.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158)
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique“The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158)”
Execution
2 techniquesDuring the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.
Discovery
6 techniques"actors used the following command ... to obtain information about services: net start"; "APT1 used the commands net start and tasklist to get a listing of the services on the system"; "OilRig has used sc query on a victim to gather information about services"; "Indrik Spider has used the win32_service WMI class to retrieve a list of services"
Multiple actors/tools are described running built-in utilities and APIs to enumerate host/network settings, e.g., "used the ipconfig /all command to gather network configuration information"; "runs the ifconfig command to obtain the IP address"; "uses ipconfig /all and route PRINT to identify network adapter and interface information"; "can use getmac and Get-NetIPAddress to enumerate network settings."
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
“3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory… admin@338 actors used… dir c:\ >> %temp%\download … APT28 has used Forfiles to locate PDF, Excel, and Word documents…”
“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”
Command and Control
4 techniquesThe content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
The adversaries had communicated to both Dropbox and Pastebin. APT28 has used Google Drive for C2. APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
"APT39 has communicated with C2 through files uploaded to and downloaded from DropBox."; "RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results ... back to Google Drive."; "CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data"
“the attackers will create a file called “[COMPUTER_NAME]_upload.bat” which contains commands to be executed… We observed the threat group upload a second stage malware… BUBBLEWRAP … to their Dropbox account”
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor that uses Dropbox as its command-and-control channel.
Malware that uses Dropbox cloud storage for command and control.
Post-compromise malware used by threat actors; observed executing Windows net localgroup commands to enumerate local groups/administrators.
Post-exploitation malware referenced in the context of host/network reconnaissance (enumerating network connections via netstat).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.