APT17__2013__hidden_lynx.pdf

Symantec outlines the activities of the Hidden Lynx group, a sophisticated, likely China-origin "hackers-for-hire" APT that has run large-scale and targeted campaigns since at least 2009. The report details major operations (VOHO, FINSHO, SCADEF), the Bit9 code-signing certificate breach used to sign malware, extensive use of zero-day browser/Flash/Java exploits, watering-hole and supply-chain distribution, custom Trojans (Moudoor, Naid, HiKit, Vasport, Boda), affected sectors (finance, government, defense, education, healthcare), and provides C2/IP/CVE indicators and mitigation guidance.