APT10 Targeting Japanese Corporations Using Updated TTPs

FireEye describes an APT10 spear-phishing campaign targeting Japanese organizations that delivered malicious Word documents with macros to install the UPPERCUT backdoor; the report details the full kill chain (drop, certutil decode, esentutil rename, Notepad++ GUP.exe sideload of a malicious libcurl.dll, shellcode unpacking, and updated backdoor functionality), network indicators (C2 domains/IPs, unique Cookie behavior, Blowfish key per-C2), and recommended mitigations such as disabling Office macros.