Intrusions commenced with the delivery of tax-themed phishing emails with attachments or links redirecting to an LNK payload, which executes either BAT or CMD scripts that result in the PowerShell and Python installer deployment before installing the RATs, an analysis from Proofpoint revealed. Threat actors’ exploitation of Cloudflare has enabled legitimacy and anonymity that hinder malicious threat detection, reported researchers.

Source: SC Magazine