Larva-25012 resumed Proxyware distribution in H2 2026, abusing already infected systems with DPLoader, PowerShell downloaders, scheduled tasks, and sideloading to install Proxyware and disable defenses in Korea. #Larva25012 #Korea #Proxyware