The latest activity cluster associated with the group commenced on May 5, 2023, and leverages a variant of RandomQuery that’s specifically designed to enumerate files and siphon sensitive data.
Source: cyware.com