ProjectSauron__2016__ProjectSauron_top_level_cyber-espionage_platform_covertly_extracts_encrypted_government_comms_-_Securelist.pdf

Kaspersky Lab details ProjectSauron (Strider), an advanced, modular nation-state cyber-espionage platform active from at least 2011 to 2016 that targeted government, military, research, telecom and finance organizations across multiple countries; the toolkit includes memory-resident implants, an extended LUA scripting engine with 50+ plugin types, sophisticated persistence (LSA password filter on domain controllers), covert exfiltration via DNS and specially prepared USB devices for air-gapped networks, and bespoke operational infrastructure per victim, with IOCs and YARA rules provided to aid detection.