I'm just glad I'm not the one being shut up this time

Great report @cyberoverdrive.bsky.social and team 😁

Our reporting overlaps this recent WSJ article:
www.wsj.com/politics/nat...

See our full research here:
www.proofpoint.com/us/blog/thre...

In these campaigns, TA415 delivered infection chains to set up VS Code Remote Tunnels 🚇 This is in line with recent TA415 phishing operations over the past year, which have relied on legit services (e,g, Google Sheets, Google Calendar, VS Code) for C2 to blend w/ trusted traffic

ELECTRONIC ESPIONAGE and ELECTRONIC CRIME ftw

Yes