Shrouded Crossbow Samples from different groups using the same filename Loader component named after its target, i.e. {target name}.exe Loader component named after its target, i.e. {target name}.exe or {target name}64.exe Backdoors using the same C&C servers Connected to 211[.]72[.]242[.]120:53 Connected to 211[.]72[.]242[.]120:443 Timeline indicating arrival order Arrived two days after initial infection by SC Established presence two years prior, but re-infected at a recent time