APT28

APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance

Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.