GOBLIN_PANDA__2018__Goblin_Panda_against_Bears.pdf

Goblin Panda (APT) used RTF exploitation (CVE-2017-11882) to deploy the Sisfader RAT against telecom targets; the report provides assembly-level analysis of anti-emulation checks, a rolling XOR decryption loop for config, persistence via service/COM object hijack, and enumerates IOCs (file hashes, domains, IP addresses) linking the infrastructure to known APT activity.