Earth Baku deploys its ongoing campaign, which can be traced to as far back as July 2020, through multiple attack vectors that are designed based on different exploits or the infrastructure of its targeted victim's environment:  • SQL injection to upload a malicious file • Installment through InstallUtil.exe in a scheduled task • Possibly a malicious link (LNK) file sent as an email attachment • Exploitation of the ProxyLogon vulnerability CVE-2021-26855 to upload a China Chopper web shell  This campaign uses previously unidentified shellcode loaders, which we have named StealthVector and StealthMutant, and a backdoor, which we have dubbed ScrambleCross.