The threat actors also use the Cobalt Strike beacons to drop the SprySOCKS loader, a variant of the Linux ELF injector called "mandibule," which arrives on targeted machines in the form of a file ...