Operation Dust Storm

Operation Dust Storm is a multi-year APT campaign documented by Cylance SPEAR that has conducted targeted espionage since ~2010 against government, defense, and later Japanese critical infrastructure sectors (power, oil & gas, finance, transportation, construction). The report provides chronology, exploitation of multiple zero-days (e.g., CVE-2011-0611, CVE-2011-1255, CVE-2014-0322), delivery methods (spearphishing, watering holes, malicious attachments, Dynamic DNS), deep implant analyses (Misdat, hybrid, S-Type, Zlib, and Android malware), and a large set of IoCs (file hashes, domains, IP addresses) to support detection and response.