New activity of The Blue Termite APT - Securelist

Kaspersky Lab reports on the Blue Termite APT campaign targeting Japanese organizations since 2013, detailing a shift to drive-by Flash exploits (CVE-2015-5119) and deployment of customized emdivi backdoors (t17/t20). The analysis covers initial infection methods (watering-hole, malicious SWF), payload extraction and execution, extensive backdoor command sets, per-sample encrypted configuration including hardcoded proxy and SID-based decryption keys, sample hashes and C2 indicators, and mitigation detections deployed by Kaspersky.