BuhTrap__2019__Buhtrap_group_uses_zero_day_in_latest_espionage_campaigns.pdf

ESET details how the Buhtrap crime group shifted from targeting Russian businesses and banks to espionage against governmental organizations (2015–2019), including use of a Windows local privilege escalation zero‑day (CVE‑2019‑1132), NSIS droppers, side‑loading of signed binaries, a password‑stealer module, and Meterpreter using DNS tunneling; the report provides technical analysis, IoCs (SHA‑1s, C2 domains, certificates) and MITRE ATT&CK mappings.