.NET DLL sideloading and name abuse

Miraak moves its command and control into cloud PostgreSQL traffic

Blackpoint found the framework because its operators left it in open web directories. The plumbing is what matters: tasking and results ride encrypted connections to a managed database, and a fake hostfxr.dll starts the agent.