APT15__2013__fireeye-operation-ke3chang.pdf

FireEye's "Operation Ke3chang" report documents a multi-year APT campaign targeting European ministries of foreign affairs using BS2005/MyWeb/BMW backdoors and spear-phishing lures (notably a Syria-themed "moviestar" campaign). The analysis covers malware internals, C2 infrastructure (dynamic DNS domains and dozens of servers), observed reconnaissance and lateral movement on compromised networks, credential-stealing tools, sample IOCs and hashes, and circumstantial evidence pointing to operators in China.