In live incidents, SoupDealer bypassed host‐based antivirus checks by confirming no security products were active before proceeding.

That’s a pretty narrow victim demographic. Windows has Defender enabled out of the box. I don’t see any investigation on the C2 connection, either, so I’m left wondering who the attacked and intended targets are.

Lol “carefully crafted sequence”. This is just like back in early versions of Windows where the login screen let you open a help menu, which let you open a file picker, which let you open any file.

Windows is a pile of shit stacked way too high.