TA547 Phishing Attack Hits German Firms with Rhadamanthys Stealer

TA547 conducted an invoice-themed phishing campaign targeting dozens of German organizations that delivered the Rhadamanthys information stealer via a password-protected ZIP and a remote PowerShell loader (the loader contains grammatically detailed comments suggesting possible LLM generation); the report also details related credential-harvesting and loader campaigns, notable TTPs (compressed LNKs, AMSI bypass, Telegram-hosted scripts), and the actor's broader history as an IAB and distributor of various malware families.