Advisory 2020-008: Copy-Paste Compromises – tactics ...

A PowerShell reverse shell payload used in conjunction with Telerik UI exploitation (see Appendix D – PowerShell Reverse Shell). This specific PowerShell reverse shell was spawned from cmd.exe. Use of PowerShell to decode and load the actor’s HTTPCore tool. ................
................