CERT-UA links UAC-0099 to a fake Notepad++ plugin that deploys BURNYBEAR and MATCHBOIL.V2, with persistence running every ...
Cruciferra uses BYOVD, API unhooking, and Process Ghosting to hide RAT and stealer payloads delivered through phishing ...