ProjectSauron__2016__Kaspersky_The-ProjectSauron-APT_research_KL_08-08-2016.pdf

ProjectSauron is a highly sophisticated, modular cyber-espionage platform discovered by Kaspersky that targets governmental and critical organizations; it uses customized in-memory backdoors (including an LSA password filter on domain controllers), a modified Lua interpreter, a virtual filesystem for plugins, and multiple stealthy exfiltration channels (DNS tunneling, crafted SMTP, and hidden encrypted partitions on USB drives to bridge air-gapped networks). Active since at least 2011 with over 30 confirmed victims, the actor prioritizes per-target customization and operational security, making detection and reuse of indicators difficult.