In December 2020, FireEye uncovered and disclosed publicly a widespread attacker campaign that is being tracked as UNC2452. In some,…