Dolphin is a sophisticated espionage backdoor used by the ScarCruft APT group against selected targets after an initial compromise by less advanced malware. It monitors fixed and portable drives, collects and exfiltrates files of interest, logs keystrokes, captures screenshots, and steals browser credentials. Rather than using dedicated attacker infrastructure for all communications, Dolphin abuses Google Drive as its command-and-control channel, consistent with other ScarCruft tooling.