TA428__2019__Chinese_APT_Operation_LagTime_IT.pdf

Proofpoint documents Operation LagTime IT, a Chinese APT campaign (TA428) targeting East Asian government IT agencies with spear-phishing using malicious RTFs that exploit CVE-2018-0798 to install Cotx RAT and Poison Ivy, detailing the malware capabilities, C2 infrastructure, IOCs, and persistent targeting as part of a state-aligned espionage operation.