VICEROY_TIGER__2019__Studying_Donot_Team.pdf

Donot Team is an active APT threat group that targets South Asia and other regions, using targeted Word documents to deliver multi-stage loaders and shellcode, including a vulnerability chain (CVE-2018-0802) and UAC bypass via modified UACMe utilities. The operation creates multiple loaders and services, harvests system information, exfiltrates data, and persists through scheduled tasks and startup items, with infrastructure hosted on DigitalOcean and frequent domain changes; the report provides IOCs and details on the attackers' methods, targets, and tools.