When the monster bytes: tracking TA585 and its arsenal | Proofpoint US

https://www.proofpoint.com/us/blog/threat-insight/when-monster-bytes-tracking-ta585-and-its-arsenal