Operation Cleaver: The Notepad Files

Operation Cleaver: The Notepad Files analyzes multiple altered Windows Notepad executables found on an attackers' FTP that were trojanized using Metasploit (msfvenom) with x86/shikata_ga_nai encoding; the report details PE-level modifications, nested decoding stubs, module/export hashing, and the final behavior (downloading/executing a Metasploit reverse-connect stager that connects to 108.175.152.230:12345), and it highlights associated IOCs (MD5 hashes and the callback IP/port) and plausible use as replacement backdoors.