It's said that the threat actor has been experimenting with these techniques since April 2024. "This campaign is under active development; it employs multiple delivery methods and custom payloads ...