InvisiMole__2020__ESET_InvisiMole.pdf

ESET's June 2020 technical report analyzes the InvisiMole espionage campaign (active since at least 2013) and its 2019–2020 toolset upgrades: two feature-rich backdoors (RC2CL/RC2FM), TCP and DNS (tunneling) downloaders, per-victim DPAPI encryption, living-off-the-land execution chains, kernel/driver and application exploits (BYOVD/BYOVS), and lateral movement using EternalBlue and BlueKeep; the investigation also uncovers operational cooperation with the Gamaredon group and provides extensive IoCs and MITRE ATT&CK mappings.