Ave Maria and the Chambers of Warzone RAT

**Executive summary:** This blog-style technical analysis dissects a multi-stage malware campaign that leverages maldocs and PowerShell environment persistence (HKU Run and Environment keys), Base64/AES-obfuscated stages, Discord-hosted payloads, a .NET netLoader DLL that extracts a packed RunPE payload, and RunPE/unhooking techniques to spawn a Notepad process that executes a Cobalt Strike beacon (C2: organitations.com/Preserve/stat/3E8YZFXJ, 69.28.84.201). The report provides IoCs, ELK search queries, registry locations for removal, and step-by-step analyst methods for decoding and dynamic debugging.