other
Newly documented .NET/C++ RAT using Google Drive folder polling as C2 with a 12-plugin in-memory .NET plugin system; roughly 65 infected instances observed.
No current published clusters are mapped here yet.