APT28__2015__Operation_RussianDoll.pdf

FireEye describes "Operation RussianDoll," a highly targeted APT28 campaign observed beginning April 13, 2015 that chained an Adobe Flash zero-day (CVE-2015-3043) with a Windows local privilege escalation (CVE-2015-1701) to gain remote code execution and SYSTEM privileges; the report includes low-level exploit analysis, shellcode/payload behavior, C2/infrastructure mappings (several IPs/domains in 87.236.215.0/24), and links the malware to APT28 families CHOPSTICK and CORESHELL.