Cybaze-Yoroi ZLAB revealed interesting a hidden connection between the AZORult toolkit and specific Gootkit payload.

https://securityaffairs.co/wordpress/81010/breaking-news/azorult-linked-gootkit.html