Beijing_Group__2012__the-elderwood-project.pdf

Symantec's "The Elderwood Project" describes a highly capable APT (Elderwood) that reused components (shared SWF, document-creation kit, packers) to deploy multiple zero-day exploits (notably CVE-2012-0779, CVE-2012-1875, CVE-2012-1889, CVE-2012-1535) via spear-phishing and watering-hole attacks against defense supply-chain firms, NGOs and other sectors, delivering backdoors and exfiltrating intellectual property; the report maps malware families, C2 domains, global detections, and recommended mitigations and protections.