APT41__2016__The_Anthem_Hack_All_Roads_Lead_to_China_-_ThreatConnect_Enterprise_Threat_Intelligence_Platform.pdf

The ThreatConnect Research Team investigates the 2015 Anthem breach and correlates malware (Derusbi/Sakula and other signed implants) and faux domains (e.g., we11point.com, prennera.com) to a wider Chinese APT campaign; the report links digital signatures (DTOPTOOLZ), C2 infrastructure, WHOIS/passive-DNS evidence and human-network connections (Beijing Topsec, Southeast University, and Song Yubo) to support an attribution hypothesis and provides indicators and timelines for related campaigns targeting healthcare, defense contractors and government personnel.