value:  SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob. ;; ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.
name: Data Obfuscation: Steganography