In this blog, I dissect a campaign that uses disk images to compromise a system, providing insight into what the Falcon Complete team has observed since 2019.