AVIVORE_reworked_v2.indd

Context documents AVIVORE, a suspected nation-state actor (likely Chinese) conducting protracted supply-chain espionage against aerospace, defence and related sectors since at least 2015; the report maps observed TTPs to MITRE ATT&CK, describes use of PlugX implants, living-off-the-land tradecraft, island-hopping via supplier relationships, credential theft and proxying of RDP/SSL VPN traffic, and provides extensive IoCs (hashes, domains, IP ranges, file paths) and mitigations to limit future compromise.