Microsoft Word - MSUpdater Trojan Whitepaper [MG4].docx

This Zscaler/Seculert report analyzes the "MSUpdater" RAT used in targeted phishing campaigns (malicious PDF attachments, including exploitation of CVE-2010-2883) against aerospace/defense and energy-related organizations; it documents VM-aware dropper behavior, detailed C2 beaconing patterns (/search..., /microsoftupdate/..., upload/download endpoints), WHOIS/domain correlations, and a consolidated list of MD5 IoCs to support detection and remediation.