Operation Daybreak

Kaspersky Lab describes 'Operation Daybreak', a ScarCruft APT campaign that deployed a zero-day Adobe Flash vulnerability (CVE-2016-4171) via spear-phishing and watering-hole techniques to deliver a multi-stage payload. The report analyzes the SWF exploit and memory corruption, documents a novel Windows DDE-based method used to execute payloads to evade AV detection, lists malware samples (MD5s), C2 infrastructure, invalid digital signatures, and several high-profile victims across multiple countries.