BitsTransfer Used to Download PHANTOMPULL Loader

Rachid O@mrrachid

•updated May 12, 2026•2•0•292

Detects PowerShell utilizing the Start-BitsTransfer cmdlet to download the 'syncobs.exe' payload, a known indicator for the PHANTOMPULL loader stage in the REF6598 campaign (PHANTOMPULSE RAT).