PROMETHIUM__2020__Newly_identified_StrongPity_operations_AT_T_Alien_Labs.pdf

Alien Labs (AT&T Cybersecurity) reports newly identified StrongPity activity: malicious, trojanized installers of trusted software (WinBox, WinRAR, Internet Download Manager) that deploy StrongPity spyware and provide persistent remote access. The report includes technical details on payload behavior (dropped executable, SSL C2 communications), compilation-time clustering, C2 domains/URIs, PE certificate metadata and numerous SHA256 hashes, and assesses the campaign as ongoing from late 2018 into mid-2019 with targeting of technically oriented users.