Attor__2019__ESET_Attor.pdf

ESET researchers describe 'Attor', a sophisticated, modular cyber‑espionage platform used in targeted attacks (diplomatic missions and government institutions) since ~2013. Attor's dispatcher injects into processes and loads encrypted plugins that collect screenshots, audio, keystrokes, device metadata and fingerprint GSM modems using AT commands; exfiltration and command/control use FTP over Tor onion services via layered internal components. The report includes detailed technical analysis, persistence and evasion techniques, extensive IOCs (file hashes, paths, registry and crypto keys) and MITRE ATT&CK mappings.