APT21__2013__kaspersky-the-net-traveler-part1-final.pdf

## Executive summary: Kaspersky Lab's public analysis of the NetTraveler (aka Travnet/NetFile) campaign documents a long-running targeted espionage operation that used spear‑phishing and Office exploits (CVE-2010-3333, CVE-2012-0158) to deploy data‑exfiltration backdoors (NetTraveler and additional payloads like Saker/Xbox and Zegost). The report provides full technical breakdowns of malware functionality, persistence, custom compression/encoding, C2 scripts and servers, extensive IOCs (MD5s, domains, IPs, filenames), victim profiling (350+ confirmed victims across ~40 countries with diplomatic, government, research and industry targets), overlap with other campaigns, and mitigation/recommendations.