https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive