A reported intrusion wave against Ukrainian targets shows how native Windows features and legitimate cloud services can turn ordinary system behavior into a covert command channel.