Darwin’s Favorite APT Group | FireEye Blog

**Executive Summary:** FireEye reports that APT12 conducted spearphishing campaigns against Taiwanese government and Japan-based technology organizations using CVE-2012-0158 weaponized Word documents to deploy multiple HTTP-based backdoors (RIPTIDE -> HIGHTIDE, and possibly THREEBYTE and WATERSPOUT), documents malware behaviors and IOCs (MD5s, C2 domains/IPs, HTTP beacon formats), and concludes the group rapidly adapts tools and TTPs after public exposure.