Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en_EN:Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en_EN.indd

FIN8's BADHATCH backdoor analysis: Bitdefender describes the evolution and technical details of BADHATCH (v2.12–v2.14), including malicious PowerShell deployment, in-memory .NET payload loading, persistence via WMI event subscriptions, token impersonation and process injection, credential dumping and lateral movement, command-and-control protocol masquerading as legitimate Windows Update traffic, lists of IOCs (IPs, URLs, sample hashes), affected sectors and recommended mitigations.