360 Threat Intelligence Center attributes an attack to APT-C-55, also known as Kimsuky, that used IBM Security Trusteer Rapport as a lure to deliver BabyShark-related components. The malicious ISO contained a BAT script and a legitimate-looking installer; execution installed the decoy product while using scripts and compromised infrastructure to download backdoor code and collect host information.