We've analyzed samples from this campaign and found AppInit DLLs being used to bypass XDR.

A custom alert has been deployed to reconnaissance in the future. After applying the emergency update, we confirmed that system weakness is no longer exploitable. During the internal, the...