An In-Depth Look at How Pawn Storm’s Java Zero-Day Was Used

Trend Micro documents Operation Pawn Storm’s targeted use of a Java zero-day (CVE-2015-2590) delivered via spearphishing to execute a multi-stage infection that drops a PE and a SEDNIT DLL backdoor/keylogger; the report includes infection chain diagrams, file hashes, network traffic patterns, C2 domains/IPs, stable IOCs, and recommended mitigations (patching and Trend Micro detection rules).