Evolution of UNC4990: Uncovering USB Malware's Hidden Depths
The actor has moved from using seemingly benign encoded text files to hosting payloads on popular websites such as Ars Technica, GitHub, GitLab, and Vimeo.
https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware
more here: posted by @peterquirk