APT27__2019__Emissary_Panda_Attacks_Middle_East_Government_Sharepoint_Servers.pdf

In April 2019 Unit 42 observed Emissary Panda exploiting SharePoint RCE (CVE-2019-0604) to install Antak and China Chopper webshells on government SharePoint servers in the Middle East, uploading tools (Mimikatz, EternalBlue scanners/exploits, HyperBro) to dump credentials, move laterally, and establish persistent C2 (185.12.45.134). The report provides technical analysis of webshells, custom backdoors, DLL sideloading techniques, timelines of uploads, and extensive IoCs for detection and mitigation.