Malware actors very rarely stick to the same script for extended periods of time. They constantly modify and update their attack methods. Recently we have observed malware that uses server-side polymorphism to hide its payload, which consists of a backdoor fully written in PowerShell.
Article Link: https://feeds.feedblitz.com/~/604518596/0/gdatasecurityblog-en~Serverside-polymorphism-PowerShell-backdoors