VB2021 paper: Operation Newton: Hi Kimsuky? Did an Apple(Seed) really fall on Newton’s head?

This VB2021 report analyzes 'Operation Newton', a November 2020 Kimsuky APT campaign that targeted scientific and engineering researchers using webmail JavaScript injection and spear-phishing to harvest credentials, deploy the AppleSeed backdoor and Meterpreter payloads, install web shells on Linux/Windows servers, move laterally via stolen VPN and server accounts, and exfiltrate research data via FTP and obfuscated channels; the paper provides full-chain TTPs, malware decoding routines (double XOR), C2 behaviors, IOCs, and a discovered command-injection OPSEC failure on the AppleSeed server that aided tracking.