A popular one is indie games. An attacker will copy the entire game and distribute it on various platforms as if they were the publisher, and add a setup progra

A popular one is indie games. An attacker will copy the entire game and distribute it on various platforms as if they were the publisher, and add a setup program - either a MSI or an all in 1 exe. This installer usually has a powershell scripting extension DLL. The worm's first stage loader is this powershell script. It works because the setup program already asked for administrator access, so the PS script runs as admin. First thing it'll do is disable Windows Defender. Then run a base64 encoded script as a command line arg to powershell as a scheduled task. And so on. Telemetry is sent back to the c2 about what AV was installed, and if it finds itself running in a sandbox or VM it will immediately exit. I haven't seen them using discord's CDN, but I'm sure some do. Redline seems to have a high amount of customization encouraged in its deployment. Each infection is a few megs of bandwidth, so if you're infection a lot of targets the bandwidth costs can be non trivial, hence using a CDN.