Tracking Elirks Variants in Japan: Similarities to Previous Attacks - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 analyzes Elirks and PlugX malware variants used in attacks in Japan, detailing how Elirks retrieves C2 addresses from Japanese blogs, outlining past campaigns in Taiwan and 2012, and describing a spear-phishing–based delivery chain that leverages CVE-2011-0611; it concludes that there are similarities between the earlier and recent campaigns and suggests an ongoing threat targeting East Asia with multiple Elirks variants.