Survival of the Fittest: New York Times Attackers Evolve Quickly | FireEye Blog

**Executive summary:** FireEye observed an APT actor (tracked as APT12) rapidly retooling its malware, deploying updated Aumlib and Ixeshe backdoors that use encoded HTTP communications, modified POST/GET URIs and altered network traffic patterns to evade existing IDS signatures. The report includes sample hashes (e.g., 832f5e01be536da71d5b3f7e41938cfb, aa87ed803ca800ce92a39d9a683c644), domains (status.jacmetoy.com, info.xxuz.com), example HTTP requests and a campaign mark ([ll65]), and concludes that deliberate changes by this sophisticated threat actor increase detection difficulty and require updated detection and attribution efforts.