APT28__2016__eset-sednit-part3.pdf

This ESET whitepaper ("En Route with Sednit — Part 3") documents Downdelph, a lightweight Delphi downloader used by the Sednit/APT28 threat actor, detailing its architecture, encrypted configuration and C2 workflow, rare targeted deployments, advanced persistence via a previously undocumented MBR bootkit and a Windows rootkit (minifilter/SSDT variants), and provides associated indicators of compromise (hashes, filenames, registry keys, domains, IPs) to aid detection and response.