Spam returns to business as usual

Attackers targeting banks in French-speaking countries using live-off-the-land and off-the-shelf tools have many similarities with the OPERA1ER group, say researchers

Such breaches might provide attackers the ability to publish valid code-signing certificates, which could then be used to sign malware

The aim appears to be intelligence gathering, rather than ransomware or data theft.