We found Earth Estries compromising existing accounts with administrative privileges after it successfully infected one of the organization’s internal servers. By installing Cobalt Strike on the system, the actors behind Earth Estries were able to deploy more pieces of malware...