APT10__2019__Uncovering_New_Activity_By_APT10.pdf

enSilo's April 2019 analysis attributes new loader activity to APT10: two DLL side‑loading loader variants that abuse jjs.exe to load a malicious jli.dll, map and decrypt svchost.bin, and inject payloads (PlugX and a modified Quasar RAT). The report details persistence methods (service registration and Run key), injection and decompression behaviors, a Quasar variant with SharpSploit/mimikatz capabilities, typosquatted C2 domains and South Korea–hosted IPs, and provides SHA256 hashes, domains, and IPs as IOCs.