GamaCopy mimics Gamaredon, using military lures to deliver UltraVNC as "OneDrivers.exe" in Russian spear-phishing.