NetTraveler APT Targets Russian & European Interests | Proofpoint

Proofpoint tracked a 2016 NetTraveler (TravNet) APT campaign targeting Russian, Mongolian and other regional interests using spear‑phishing (RAR SFX links and CVE-2012-0158 Word exploits) to deploy NetTraveler; the report documents TTPs (DLL side‑loading), attacker infrastructure and domain registration patterns, extensive IOCs (domains, IPs, URLs, SHA256 hashes), sample decoys, and attributes activity to a China‑based actor with connections to prior PlugX activity.