Bullseye: A Story of a Targeted Cyberattack | Huntress

This Huntress analysis describes a targeted PowerShell-based persistent backdoor that used a scheduled task to run obfuscated PowerShell which downloaded segmented Base64/GZIP payloads, reflectively loaded a .NET DLL to invoke Win32 APIs, patched AmsiScanBuffer to bypass AMSI, and attempted to establish an Empire beacon via a typosquatted vendor-like C2 domain.