Wild Neutron - Economic espionage threat actor returns with new tricks - Securelist

The document analyzes the Wild Neutron threat actor (Jripbot/Morpho), detailing its 2011–2015 activity, including modular backdoors, cross-platform zero-day exploits, a stolen Acer code-signing certificate, watering-hole techniques, and extensive IOC data. It highlights targeted sectors and countries, sophisticated tooling and exfiltration methods, and conclusions that the group represents a non-nation-state espionage operation with notable operational security and cross-platform capabilities.