GENERAL__2020__Multi-stage_APT_attack_drops_Cobalt_Strike_using_Malleable_C2_feature_-_Malwarebytes_Labs_Malwarebytes_Labs.pdf

This report documents a multi-stage APT-like campaign that starts with a malicious Word resume exploiting template injection to drop a .NET loader, establishes persistence, then uses a Malleable C2 profile of Cobalt Strike to download and execute a second payload and maintain beaconing to a C2 domain, providing IoCs and attribution context for Mustang Panda/APT41-style activity.