Supply Chain Compromise
Abuse of AirWatch/Workspace ONE Unified Endpoint Management API for covert C2
Data exfiltration via MDM blob storage (/api/mam/blobs/uploadblob)
Browser data theft (Cookies, History, Bookmarks) from Chrome, Edge, and Island Browser
Screen capture for intelligence gathering
Use of stolen digital certificates for binary signing
PE timestamp manipulation for defense evasion
Multi-threaded C2 communication protocol
Persistence via scheduled tasks