Two recent fileless malware campaigns targeting financial institutions, government agencies and other enterprises have been linked to the same attack group.