APT31 Intrusion set campaign: description, countermeasures and code

ANSSI's December 15, 2021 report analyzes an APT31 campaign that used exploited Exchange and VPN vulnerabilities and a mesh of compromised SOHO routers (Pakdoor) as an anonymisation/C2 layer to deploy tools such as Cobalt Strike, escalate privileges, persist via scheduled tasks and web shells, and exfiltrate emails and business data; the document enumerates TTPs, IOCs, impacted software/models, and mitigation recommendations.