Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

**Operation HollowQuill**: SEQRITE Labs APT team uncovered a targeted campaign against Baltic State Technical University employing weaponized decoy PDFs inside a malicious RAR that drops a .NET dropper which installs a legitimate OneDrive binary, a Golang shellcode loader (APC injection into OneDrive.exe), and an in-memory Cobalt Strike beacon; the report provides technical stages, IOCs (MD5s, C2 phpsymfony.com), MITRE mappings, and hunting notes.