Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue

Palo Alto Networks Unit 42 describes DealersChoice, an exploitation platform used by the Sofacy (APT28) group that weaponizes RTF/Word documents with embedded Flash (SWF) exploits — including an observed Flash zero-day (CVE-2016-7855) — to fetch and decrypt exploit code and loader payloads from multi-stage C2 infrastructure; the report provides C2 workflow diagrams, sample and payload SHA256 hashes, domain registrant details, victim fingerprinting behavior, and recommended detections/mitigations.