Cobalt Strike

Miraak moves its command and control into cloud PostgreSQL traffic

Blackpoint found the framework because its operators left it in open web directories. The plumbing is what matters: tasking and results ride encrypted connections to a managed database, and a fake hostfxr.dll starts the agent.