OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan

Unit 42 observed a new version of the Clayslide delivery document used to install a new custom Trojan whose developer calls “ALMA Communicator”.