APT40__2020__Leviathan_APT_campaign_in_2020_Malaysian_political_crisis_Elastic_Blog.pdf

Elastic Security Intelligence & Analytics analyzed a targeted APT campaign (likely APT40/Leviathan) that weaponized Microsoft Word remote templates and obfuscated VBA to drop and execute embedded DLLs (sl1.tmp, sl2.tmp) which download a Logitech-signed LogiMailApp.exe and side-load a malicious LogiMail.dll; the malicious DLL performs in-memory decryption and maps a second-stage backdoor that supports discovery, file exfiltration, command execution, persistence, and AES-encrypted C2 over dynamic DNS. The blog includes detailed technical analysis, IoCs (filenames, registry keys, URLs, IPs, certificate and many hashes), MITRE ATT&CK mappings, and a YARA rule to aid detection and response.