Roaming_Tiger__2016__PaloAlto_BBSRAT-Attacks-Targeting-Russian-Organizations-Linked-to-Roaming-Tiger_Dec-22-15.pdf

This Unit 42 report analyzes BBSRAT, a remote access Trojan used in the Roaming Tiger espionage campaign targeting Russian organizations, detailing spear-phishing delivery, two deployment methods (CAB dropper with DLL sideloading and a PowerSploit-based downloader), process-hollowing and reflective injection execution, persistence via registry/COM, C2 protocol and commands, IOCs (hashes and domains) and a YARA detection rule.