APT12__2016__FireEye_Operation-Beebus_Feb-1-13.pdf

FireEye describes 'Operation Beebus', a targeted APT campaign against aerospace and defense organizations using spearphishing and drive-by downloads with weaponized PDFs/DOCs (multiple CVEs) and DLL search-order hijacking for persistence; the malware encodes/exfiltrates data to C2 servers (modified base64 with character substitutions), with provided IoCs (MD5s, domains, IPs), timelines, and attribution to a China-linked group leveraging HTran and obfuscated HTML comment techniques.