Symantec attributes the DEEP#GOSU campaign to Springtail, also known as Kimsuky or Thallium. The attack chain uses .LNK files, embedded PowerShell, and VBScript stagers to download payloads hosted on Dropbox. The final malware combines infostealer and backdoor functions, including clipboard monitoring, keylogging, and data exfiltration. The source identifies Symantec’s CL.Downloader!gen241 detection and notes that observed domains and IPs are covered through WebPulse security categories.