Stealth In Layers: Unmasking The Loader Used In Targeted Email Campaigns

**Executive summary:** CRIL details a targeted, multi-stage malware campaign leveraging weaponized email attachments and steganographically embedded payloads to reflectively load a trojanized .NET TaskScheduler assembly that performs process hollowing and delivers Remote Access Trojans and PureLog Stealer; the report documents a novel UAC bypass, comprehensive MITRE mappings, and actionable IOCs (hashes, URLs, IP) affecting manufacturing and government organizations in Italy, Finland, and Saudi Arabia.