IXESHE: An APT Campaign

Trend Micro's 2012 research paper analyzes the IXESHE APT campaign (active since 2009) that used targeted spear-phishing with weaponized PDF/XLS exploits—including two zero-days—to deploy remote-control/backdoor malware against East Asian governments, electronics manufacturers, and a telecommunications company; it documents malware behaviors, bespoke C2 formats and custom Base64 alphabets, extensive compromised C&C infrastructure (≈60 servers), campaign tags/IOCs, timelines, and recommended detection/mitigation strategies.