SWEED__2019__Comprehensive_Threat_Intelligence_SWEED_Exposing_years_of_Agent_Tesla_campaigns.pdf

SWEED is a long-running threat actor whose campaigns distribute Agent Tesla and other information stealers through spear-phishing, Java droppers, and Office exploits (CVE-2017-8759, CVE-2017-11882) since 2017, with packed/obfuscated payloads, reusable infrastructure, and extensive IOCs and typosquatting; the report documents campaign timelines, infrastructure, and OPSEC, highlighting ongoing global activity and risk to organizations.