APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS

NCC Group details an APT15 compromise of a UK government services provider, identifying new and existing backdoors (RoyalCli, RoyalDNS, BS2005), bespoke tools (spwebmember, Exchange/SharePoint dumpers), use of Mimikatz and Golden Ticket techniques, persistence via stolen VPN certificates and DNS/IE-based C2, recovered attacker commands (>200), and published IOCs (hashes, domains) and detection signatures.