Has TeamPCP Pivoted To Using The PureHVNC RAT?

**Executive Summary:** This blog post analyzes a multi-stage campaign that uses an obfuscated PowerShell script masquerading as an MP3 to deliver a .NET stealer (MidwestGrey.exe) and ultimately deploy the PureHVNC RAT; dynamic sandboxing showed credential and crypto-wallet exfiltration, hidden VNC access, RC4-protected C2 configuration, active C2 IPs and numerous IOCs, and the author assesses with low confidence that the activity is not TeamPCP but rather a commodity cybercrime operator.