• Delivery: sponsored result via googleadservices.com redirect to rvtok[.]app (polls rvtooks[.]com), then web-app-server-gqdmgecbb2e6czg3.z03.azurefd[.]net/id-RVTools4.7.1?q=RVTools, then Dropbox. Infrastructure first seen May 25, 2026.
• Installer tells: unsigned MSI whose ProductName/Manufacturer don't match (e.g. TeamsUpdater_A28 / UpdateSoft_U3E3AX), installing to Program Files (x86)\TeamsUpdater\ or \UpdateWindowsSoft\.
• On host: deploy.bat extracts python.zip with tar.exe into C:\ProgramData\Microsoft\DiskCleanup\ or \DeviceSync\; pythonw renamed UsbService64.exe; SYSTEM scheduled tasks LanguagePack (one-time, +5 min) and SecurityHealth (logon), or DeviceSyncInit/DeviceSyncAgent/DeviceSyncCleanup; Run values OfficeHelper or MyAppUpdate; in one sample, MSDTC persistence via HKLM\SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath.
• C2: HTTPS POST, AES-CBC plus HMAC, TLS verification off, to red-fire-92b4.redis-3a9.workers[.]dev and rough-base-bddc.web-static-4jf.workers[.]dev; a burst of about six connections in the first 45 s, then quiet for 72 h, then 20-minute polls. Carries an encrypted .NET assembly loaded in memory via pythonnet once C2 sends the key (contents unknown).

Hunt ideas: search historical telemetry back to late May for the domains and hashes in Vega's post (e.g. MSI SHA-256 4d5b1ead...ce34ee5, c3986133...ff605677); renamed python/pythonw anywhere under ProgramData\Microsoft; schtasks creating SYSTEM tasks that run .bat files from user-writable folders; Windows Installer events 1033/11707 for MSIs named like admin tools. If an admin workstation is hit, review vCenter/ESXi access and rotate credentials and vault secrets reachable from it.