Roaming_Tiger__2014__sophos-rotten-tomato-campaign.pdf

SophosLabs' analysis of the “Rotten Tomato” campaign details how multiple attacker groups reused and combined RTF exploit templates leveraging CVE-2012-0158 and CVE-2014-1761 to deliver varied payloads (Plugx, Zbot, Goldsun, Appat). The report catalogs technical workflows, failed and successful integration attempts, sample hashes, dropped file paths, persistence methods, and numerous C2 domains, highlighting both APT-like and commodity crimeware behaviors and providing concrete IoCs and TTP observations.