APT17__2015__APT17_Report.pdf

FireEye and Microsoft describe how the China-based APT17 (DeputyDog) used the BLACKCOFFEE backdoor to hide C2 infrastructure by embedding encoded CnC IP addresses in legitimate Microsoft TechNet profile pages and forum threads (a dead-drop resolver technique); the report details BLACKCOFFEE's capabilities, the decoding mechanism, published IOCs, and mitigation actions taken to sinkhole and observe victims.