NetTraveler APT Gets a Makeover for 10th Birthday - Securelist

This report documents an updated NetTraveler APT campaign: attackers sent targeted spear‑phishing e-mails with a malicious .DOC exploiting CVE-2012-0158 to drop a trojan dropper (net.exe) and a backdoor DLL (Windowsupdataney.dll), register persistence, and connect to identified C2 domains; the analysis provides file hashes, mutexes, C2 domains/IPs, config decryption method, affected industries (diplomatic, government, military, etc.), and recommends blocking the listed hosts.