code injection

What happened? Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe