Leafminer group detected exfiltrating sensitive data using Dropbox as a C2 channel. This communication was disguised to appear legitimate, but analysis revealed indicators consistent with malicious activity.