Dissecting A Multi-Stage PowerShell Campaign Using Chisel

CRIL identified a sophisticated multi-stage infection chain that starts with a malicious LNK invoking an obfuscated PowerShell payload which drops secondary and tertiary PowerShell stages to maintain persistence, communicate with C2 (https://c2.innov-eula.com and https://ligolo.innov-eula.com), and execute received commands; an open directory hosts the LNK and a Chisel DLL used to create tunnels (via a Netskope proxy) for covert C2 and lateral movement, and the report supplies IOCs (SHA256 hashes, domains, URLs) and detection recommendations.