MirageFox: APT15 Resurfaces With New Tools Based On Old Ones - Intezer

Intezer's blog describes 'MirageFox', a remote access trojan attributed with high confidence to APT15, showing code reuse with earlier Mirage/Reaver samples. The report includes static/reverse-engineering details (exported dll_wWinMain, DLL-hijack behavior, decrypted C2 config pointing to an internal IP and port 80), multiple SHA256 hashes and C2 indicators, and concludes this is a targeted espionage campaign likely tailored to previously compromised networks.