Do Son Veil#Drop malware abuses Blogspot to run PowerShell loaders and deploy PureLog Stealer in memory, dodging antivirus and file-based detection.
PowerShell Loader
Operation FrostBeacon targets Russian B2B with Cobalt Strike. The dual attack uses LNK files and chained legacy exploits (CVE-2017-0199/11882) to gain persistent, financially motivated access.