2021-05_FancyBear

This Cluster25 report analyzes a previously unreported APT28 implant called "SkinnyBoy," describing a multi-stage spear-phishing campaign that delivers a DLL downloader, a Base64‑overlaid dropper (tdp1.exe), a launcher (devtmrn.exe) and an implant DLL (TermSrvClt.dll). It documents persistence mechanisms, data-collection and exfiltration to C2 (updaterweb.com/getstatpro.com and listed IPs), provides YARA rules and extensive IOCs (file hashes, domains, IPs) and maps observed behaviors to ATT&CK techniques while attributing the activity to APT28 with medium-high confidence.