VB2015_Catching_the_silent_whisper

This Fortinet/Virus Bulletin presentation analyzes the Derusbi DLL-based remote-access trojan family (2008–2015), describing its variants, modular C++ classes, persistence via masqueraded service DLLs, optional embedded drivers, C2 behaviors and sample-specific IOCs; it ties Derusbi to high-profile intrusions (Mitsubishi, CareFirst, Anthem) and actor activity attributed to Deep Panda, and recommends detection points such as class/modular structure, IPS signatures and monitoring of registry/service paths.