MULTI__2015__2015-09-20150911-280-CSIT-15085-NfLog.pdf

This report analyzes a new NfLog RAT variant (IsSpace) used by the SAMURAI PANDA threat actor, deployed through a leaked Hacking Team exploit (CVE-2015-5122) and hosted C2 communications on Google App Engine, describing its basic C2 polling, persistence, privilege escalation, proxy credential sniffing on older Windows and firewall-aware behavior, indicating a credible malware campaign with sophisticated capabilities.