Early in our investigation of, and takedown operation against, a broad exploitation campaign we call Schoolbell1 , RSA Research observed unidentified beaconing to the URL www.oraclesoft[.]net2. We did not know what was causing