APT2__2020__The_footprints_of_Raccoon_a_story_about_operators_of_JS-sniffer_FakeSecurity_distributing_Raccoon_stealer.pdf

**Executive summary:** This report describes a multi-wave campaign (Feb–Sep 2020) by FakeSecurity operators who distributed Raccoon stealer (and Vidar) using phishing docs with malicious macros, Mephistophilus phishing kits, modified FakeSecurity JS-sniffer injections on e‑commerce sites, and Telegram-based C2 updates; the report provides timelines, dozens of malicious domains and IPs, sample hashes, and mitigation recommendations.