Microsoft Word - The Slingshot APT_report_ENG_final.docx

Slingshot is a highly sophisticated cyber-espionage platform active since at least 2012, described by Kaspersky as rivaling projects like Sauron and Regin. It uses a loader to patch legitimate Windows DLLs, loads kernel-mode and user-mode payloads (Cahnadr and GollumApp), deploys via drivers and compromised routers (notably Mikrotik Winbox), and targets victims mainly in Africa and the Middle East with a modular, stealthy architecture.