Sophisticated Attack Campaign Exposes Loader Used by Multiple Threat Actors

Cyble researchers describe a sophisticated, targeted campaign using a standardized commodity loader shared by multiple high-capability threat actors to deliver RATs and infostealers. The campaign leverages steganography to hide payloads in images, string reversal/Base64 obfuscation, abuse of legitimate .NET executables for process hollowing, and a novel UAC bypass; targets include manufacturing and government entities in Europe and the Middle East, with IoCs and TTP mappings provided in the full report.