Unclear
Commercial pentesting suites, custom anti-detection wrappers and last stage Trojans.
The actors uses an innovative technique of putting the shellcode into Windows event logs, allowing the “fileless” last stage Trojan to be hidden from the filesystem. They employ a set of custom tools along with several commercial pentesting frameworks, such as Cobalt Strike and NetSPI (ex-SilentBreak). With these in use, plus several types of last stage RAT and anti-detection wrappers, the actor behind this campaign is quite capable. The code is quite unique, with no similarities with known malware.
What's also noteworthy is that in September 2021 we observed the SilentBreak toolset used in malicious campaings in other regions – the Middle East and North Africa.