We discovered a second malware family, mapped approximately 20 ghost servers with consistent configurations, attempted to exploit the C2 infrastructure—and ended up questioning whether we were hunting them, or they were hunting us.