Kelsey on Twitter: "#IcedID "3131022508" dropped via PDFs with payloads hosted on firebasestorage\.googleapis\.com.* Thread-hijacked email -> PDF Attachment -> payload download -> Password-Protected Zip -> ISO -> LNK -> CMD -> DLL c2: wagringamuk\.com https://t.co/o4MUWUfhMa https://t.co/mUfZjQ8MeA" / Twitter
https://twitter.com/k3dg3/status/1612495824369471488