Hogfish Redleaves Malware Threat Analysis I Accenture

This Accenture iDefense report analyzes a targeted espionage campaign by HOGFISH (APT10) using RedLeaves implants against Japanese victims: a malicious Word document drops an obfuscated DLL and a signed binary, performs process hollowing into iexplore.exe, persists via Startup shortcuts, communicates with hardcoded C2 domains over HTTP (encrypted with RC4), and exfiltrates credentials and screenshots; the report provides IoCs (hashes, domains, IPs, mutexes, file paths) and mitigation guidance for SOCs.