Sophos has tied a previously undocumented cluster to eight DLL sideloading chains that leaned on signed, everyday Windows tools.