PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers. Mimikatz - PowerShell and Binary versions, with multiple layers of obfuscation