Sandworm intrusion set campaign targeting Centreon systems

**ANSSI report (27/01/2021):** Technical analysis of a multi-year intrusion campaign targeting Centreon monitoring servers that deployed the P.A.S. PHP webshell and the Exaramel Go backdoor, affecting several French entities (notably IT and hosting providers); the document provides malware code analysis, persistence and C2 infrastructure details, YARA/Snort detection rules, IOCs, recommended mitigations, and assessments linking the campaign to the Sandworm/TeleBots intrusion set.