Decoding Water Sigbin's Latest Obfuscation Tricks

The group performed fileless execution by using .NET reflection techniques in PowerShell scripts, which allows the malware code to run solely in memory, avoiding disk-based detection mechanisms.