Russian-backed state hackers have begun to shift to online storage services to mask their attacks from detection. These actors, tracked as Cloaked Ursa, APT29, and Cozy Bear, have incorporated services such as DropBox and Google Drive into their campaigns. With the utilization of such popular online services backed by millions, it allows threat actors to gain trust with their victims (prior to infection) and makes it harder for security practitioners to trace the compromise. Recently, an extremely targeted spear-phishing campaign utilized a malicious PDF document with Dropbox hyperlinks. These hyperlinks were crafted to direct the user to download the malicious payload EnvyScout, which is capable of conducting reconnaissance on the infected system, communicating back to actor-controlled command-and-control (C2) servers, and establishing persistence on the system. In other campaigns, Cloaked Ursa actors utilized politically themed phishing emails to deliver similar malicious payloads via Dropbox hyperlinks. These payloads also allowed for the communication between the infected system and threat actors through the Google Drive API, granting access for uploads and downloads from the compromised system. With phishing campaigns continuing to be on the rise throughout 2022, CTIX analysts urge users to validate the integrity of all email communications prior to opening any attached documentation or embedded links.