> Victims, looking forward to confirming they were up for cocktails and canapes, were directed to click on a link to a hijacked, Cozy Bear-controlled website –

> Victims, looking forward to confirming they were up for cocktails and canapes, were directed to click on a link to a hijacked, Cozy Bear-controlled website – waterforvoiceless[.]org/invite.php – which would download a .zip file. Marks who opened the archive and then its contents would end up executing a program called ROOTSAW, which would infect the PC with the WINELOADER backdoor, fetched from waterforvoiceless[.]org/util.php It is a damning indictment of modern UI design that users will mindlessly click through so many intricate and red-flaggy steps without stopping to wonder if ROOTSAW.EXE which they have just extracted from an unexpectedly received .zip file is really a plausible invite confirmation mechanism.