The new variants, improved for stealth and persistence, share code with other malware samples attributed to the C-23 APT.