QUILTED_TIGER__2016__The_Dropping_Elephant_actor_-_Securelist.pdf

Dropping Elephant (aka Chinastrats/Patchwork) is an APT campaign active since at least November 2015 targeting diplomatic and economic organizations in the Asian region through spear-phishing and watering-hole lures that exploit known Microsoft Office vulnerabilities (e.g., CVE-2012-0158, CVE-2014-6352/1761) to deliver UPX-packed AutoIT backdoors which launch PowerShell loaders and file-stealers to exfiltrate Office/PDF documents; the report contains malware and C2 analysis, victim geography and activity patterns, and comprehensive IoCs to support detection and mitigation.