A new campaign has been identified as DEEP#GOSU is likely linked to the Kimsuky group, and it employs a new script-based attack chain that uses numerous PowerShell and VBScript stagers to stealthily infect systems.  Its features included data exfiltration, keylogging, clipboard monitoring, dynamic payload execution, and persistence via scheduled activities, self-executing PowerShell scripts using jobs, and RAT software for complete remote access. “The malware payloads used in the DEEP#GOSU represents a sophisticated, multi-stage threat designed to operate stealthily on Windows systems especially from a network-monitoring standpoint”, Securonix Threat Research Team shared with Cyber Security News.

Source: GBHackers