DYEPACK is described as part of APT38’s arsenal for intrusions against financial institutions and SWIFT environments. APT38 gathered information about personnel and exposed organizational resources, used spear-phishing or vulnerabilities such as insecure Apache Struts2 servers to gain execution, and moved laterally toward SWIFT systems before deploying specialized tooling. DYEPACK is named as a framework introduced after attackers compromised an external server, but its own components, platform, execution flow, persistence, command set, and communications are not distinguished from the broader bank-heist operation. The label therefore requires review before it can support a definitive malware-family profile.