DeadlyKiss APT

## Executive summary This report details the discovery and technical analysis of "DeadlyKiss", an advanced, highly obfuscated C++ loader/backdoor observed since 2016 that targets Internet Service Providers and related organizations; it uses AES-256 encrypted payloads, flexible persistence (COM in-process or system service, scheduled tasks), timed HTTP C2 communications, and strong evasion techniques, and includes IoCs (domains, IP, hashes) and a detection rule.