TrendLabs: Waterbear is Back, Uses API Hooking to Evade Security Product Detection

Figure 1. A typical Waterbear infection chain

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection/