APT30__2015__rpt-apt30_9d78ff20.pdf

FireEye describes APT30, a likely state‑sponsored, decade‑long cyber espionage operation focused on Southeast Asia and India that uses a consistent suite of bespoke tools (BACKSPACE/Lecna, NETEAGLE, SHIPSHAPE, SPACESHIP, FLASHFLOOD), two‑stage C2 infrastructure, spear‑phishing with localized decoys, and removable‑drive techniques to exfiltrate sensitive/government data (including air‑gapped networks); the report includes controller GUI analysis, command sets, versioning, targeting patterns around ASEAN events, and numerous IOCs and MD5 hashes.