The Iran-linked MuddyWater crew ran a four-continent espionage campaign mostly using... legit software. Signed binaries, DLL side-loading, Node.js instead of PowerShell, data exfiltrated through a normal file-sharing site.
If you're not watching behaviour, you're watching the wrong layer.

