Naikon__2015__TheNaikonAPT-MsnMM2.pdf

This Kaspersky Lab analysis documents the Naikon (MsnMM) APT campaigns targeting ASEAN government, military, law-enforcement and related organizations using CVE-2012-0158 and RTLO spear-phishing to deliver multiple custom backdoors and loaders (sslMM, winMM, sys10, xsPlus/nokian, exe_exchange, etc.), details the actors' TTPs and lateral-movement toolset (including custom HDoor variants and public admin tools), and provides extensive IoCs (MD5 hashes, C2 domains) and detection names to support defensive actions.