CIRCLE WITH A DOT

The full report can be found here and is well worth the read. https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf2/2

@darfplatypus This python dropper is tracked as "CastleLoader", there are a few actors that are leveraging it. Also, happy to talk via email or another medium if desired. (My email is Squiblydoo@pm.me)

Golden Eye Dog (APT-Q-27) seems to have come back from break.We've seen 6 unique EV code-signing certs for campaigns in April already. All of these get reported and all get revoked. More about them in the thread. h/t @g0njxa, @malwrhunterteam1/4