One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub. The malware was a python-based implant using Dropbox for command and control. Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection