Retour 
Netskope Threat Research Labs posted an article in February detailing a growing trend in PDF decoys, which consists of using a “default allow” policy that uses cloud storage services to infect user devices with an infamous Remote Administration Tool (RAT) named Nanocore. The malware was delivered from Dropbox using a RAR compressed archive with UUE extension. Recently, we observed the malicious actors updated the extension name to .r11 using annotations in PDF decoys. The malicious payload resident in the Dropbox cloud storage service as well as an attempt to download them is detected by Netskope Threat Protection as Backdoor.Generckd.5034232.
The PDF decoys are traditionally sent as email attachments to users at various enterprises. In a number of enterprises, email attachments are often automatically synced to cloud storage services using file collaboration settings in popular SaaS applications and third party applications. Since the filenames appear less suspicious, they are more likely to be viewed as coming from within the organization (and therefore trusted) and shared with others in the same user group thereby resulting in a CloudPhishing fanout effect.
R11 file extension
After the initial discovery in February, we continued to see frequent usage of the .uue file extension in Dropbox. We closely worked with Dropbox to take down the URLs hosting the .uue extension malicious payloads. Similar to the .UUE file format, traditional compression tools like WinRAR and WinZip also support the decompression of the .r11 file format. A list of programs that can open files with .r11 extension can be found here. Since the payload is a malicious .RAR compressed archive with a .r11 extension, they end up successfully detonating, when the victim inadvertently executes the file. The usage of the .r11 file extension could be another attempt from the attackers to bypass network security devices.
PDF decoy downloading Nanocore RAT with R11 extension
The PDF decoy we observed posed as a document related to Rhenus Maritime Services. Upon opening the PDF decoy and clicking anywhere in the document, a RAR compressed archive, named “Rhenus Maritime Services.r11” is downloaded from Dropbox to the victim’s machine. Rhenus Maritime Services.r11 contained an executable file called “Rhenus Maritime Services.exe” as shown in Figure 1.
Figure 1: Rhenus Maritime Services.r11 RAR compressed archive
The activity illustrating the delivery mechanism is shown in Figure 2.
Figure 2: Delivery Mechanism of the PDF decoy
We also found that the PDF decoy was annotated using the RAD PDF annotator, as shown in Figure 3.
Figure 3: RAD PDF annotator
At the time of writing, we did not see any additional links used in the annotations. Nevertheless, the usage of RAD PDF annotator indicates that the attackers plan to reuse the Rhenus Maritime Services template by annotating new links w