NanHaiShu: RATing the South China Sea

F-Secure Labs' whitepaper analyzes NanHaiShu, a Remote Access Trojan delivered via spearphishing Office documents containing VBA macros that decode and run embedded JScript/HTA payloads. The report documents targeted espionage against entities involved in the South China Sea arbitration (e.g., the Philippines DOJ, APEC organizers, an international law firm), describes technical and behavioral indicators (persistence, data collection, HTTP-based C2, obfuscation), provides sample hashes and C2 records, and assesses likely Chinese origin based on code artifacts, infrastructure changes, and target selection.