Blackgear__2016__BLACKGEAR.Espionage.Campaign.Evolves.-.Trend.Micro.pdf

This Trend Micro analysis documents the BLACKGEAR espionage campaign (historically tied to ELIRKS) that uses binders, downloaders and backdoors which retrieve encrypted C2 configuration hidden in blog/microblog posts to maintain resilient command-and-control; the report includes decryption details, persistence behaviors, links between tool families, and extensive IOCs, and notes the campaign's expansion to Japanese targets.