In this incident, CARBON SPIDER also used the KillACK PS backdoor, executing the malware using both PowerShell and PowerShell ISE. KillACK sends host information to a C2 server (in this case, againcome[.]com or besaintegration[.]com) and executes provided PS script blocks. Multiple KillACK modules have been observed by CrowdStrike Intelligence, including modules for conducting self-propagation and AMSI hot-patching, as well as for executing Cobalt Strike stagers and enumerating network information.