Kaspersky cybersecurity experts: To evade detection, it host its communications with the C2 on public cloud services and hides the main malware with steganography.
IBM cyber security experts: The malware spread via malspam with Office attachments. Files boobytrapped with malicious macros that launch infection routine, fetch and run the payload.
Cylance cyber security experts: Some contain code associated with the XMRig Monero CPU miner. Others included Metasploit. One loader use steganography to decode-execute PE file.
Yoroi-Cybaze ZLab cyber security experts: Threat Actors implement country-checks and over 10 levels of code obfuscation, in addition to a new steganography technique for Windows 10.
The banking trojan is spreaded through mails with malicious attachments. It builds a PowerShell command from a downloaded image, thanks to steganography.