VERY IMPORTANT

First publicly identified by @360Netlab, suspicious activity likely related to post-compromise IoT device actions. Scripts send stolen information to external destination. Scripts are downloaded through various steps. See references for more details. Leading infection vector is unknown at this time.