APT1__2013__comment_crew_indicators_of_compromise.pdf

This Symantec Security Response provides a consolidated set of indicators of compromise attributed to the "Comment Crew" threat actor, listing malicious domains, IP addresses, HTTP patterns, file names and hundreds of MD5 hashes, registry and service artifacts, and email subjects/attachments used in their campaigns to support detection and incident response.