Microsoft PowerPoint - CCT-W08_Evolving-Threats-Dissection-of-a-Cyber-Espionage-Attack.pptx

**Executive summary:** This RSA Conference presentation documents a multi-stage APT28 cyber-espionage campaign against a segmented military Active Directory environment that used spear-phishing and weaponized Word exploits to deliver CORESHELL (downloader), EVILTOSS (backdoor) and the CHOPSTICK RAT, leveraged vulnerabilities (including MS14-068 and CVE-2015-1701) and Mimikatz to escalate, harvest credentials and compromise AD, and details C2 infrastructure, observable IOCs and an IR methodology used to detect, enumerate and remediate infections.