Doing time with the YIPPHB dropper

This Elastic Security Labs analysis details an intrusion set (REF4526) that uses creative PowerShell obfuscation (Unicode icons inside Base64 strings replaced at runtime) to download a .NET loader, a YIPPHB dropper, and RAT implants (NJRAT/LIMERAT). The report documents the loader/dropper/RAT phases, provides decoded IOCs (SHA-256 hashes, TinyURL and Discord-hosted URLs, and a C2 domain), clusters of related activity, and practical collection/hunting procedures and queries to detect similar activity.