APT32__2020__Threat_actor_leverages_coin_miner_techniques_to_stay_under_the_radar_here_s_how_to_spot_them_-_Microsoft_Security.pdf

Microsoft Threat Intelligence details BISMUTH (a nation-state APT) campaigns that used targeted spear-phishing with malicious Word documents to sideload DLLs and create scheduled tasks for persistence; attackers then conducted extensive discovery and lateral movement, deployed Monero coin miners to distract defenders, installed Cobalt Strike beacons, and used Mimikatz for credential theft and exfiltration. The report includes observed filenames and artifacts, a mapped attack lifecycle with MITRE ATT&CK techniques, and practical mitigation and detection guidance for defenders.