Hacking_Team__2018__new-traces-hacking-team-wild.pdf

ESET researchers report new, post-2015-leak samples of Hacking Team’s Remote Control System (RCS) spyware observed in the wild across 14 countries; analysis of compilation dates, certificate chains, versioning and coding style indicates continued development by Hacking Team developers rather than unrelated reuse of leaked source code. The report details technical differences from pre-leak builds (e.g., padding change from 4MB to 6MB), use of VMProtect, valid digital certificates issued in sequence, spearphishing distribution (executable disguised as PDF), and provides extensive IoCs including SHA-1 hashes, C2 IP addresses, and certificate thumbprints for researcher and defender use.