Finally, the script contents of blog-page[.]html schedule the same task (“MSOFFICEER”) to run itself. Revenge RAT used in this instance is not dropped to disk but is instead loaded into the memory of a process using the “Reflection.Assembly” PowerShell command. A similar method is used to execute the script content of the command and control locations rather than dropping the scripts to disk and then running them. By scheduling tasks to run scripts and binaries in memory rather than on disk, the threat actors are able to avoid some traditional means of detection