Lotus Blossom Continues ASEAN Targeting

Lotus Blossom ran a targeted malvertising campaign against ASEAN-related targets delivering an RTF decoy that exploited CVE-2017-11882 to drop the Elise backdoor (NavShExt.dll), which is injected into iexplore.exe to perform data collection and C2 to 103.236.150.14; the report provides process timelines, registry autorun persistence, network captures, code excerpts showing AES/Base64 cookie encoding for C2, and multiple file and hash indicators for detection.