Elastic finds four REVSTEALER companion modules that persist after the stealer deletes itself, including one that mines crypto.
The Sleepwalker backdoor waits in memory for one magic packet, then runs commands in its own language.