MONSOON – ANALYSIS OF AN APT CAMPAIGN

Forcepoint Security Labs presents an in-depth analysis of the MONSOON APT campaign (Dec 2015–Jul 2016) that used topical lure documents and multiple weaponised exploits to deliver BADNEWS, TINYTYPHON, AutoIt backdoors and Unknown Logger; the malware used resilient C2 via RSS/GitHub/forums and exfiltrated sensitive government and military documents across South Asia, with extensive IOCs, exploited CVEs and infrastructure overlaps linking MONSOON to previously observed HANGOVER activity.