https://www.threatdown.com/blog/rhysida-using-oyster-backdoor-to-deliver-ransomware/