[SurceBeats]

The sophistication here (SVG > CHM > fileless execution > dual payload) suggests access to commercial malware toolkits rather than bespoke APT development.

[Stasshe]

And, it might be taking longer to discover because it's hard to notice with SVG.