APT10__2020__Japan-Linked_Organizations_Targeted_in_Long-Running_and_Sophisticated_Attack_Campaign_Symantec_Blogs.pdf

- Symantec reports a wide-ranging, long-running espionage campaign (mid‑Oct 2019 through Oct 2020) attributed to Cicada/APT10 targeting Japan-linked organizations and MSPs across many countries; attackers used DLL side‑loading, living‑off‑the‑land tools, a custom backdoor (Backdoor.Hartip), QuasarRAT, and a tool to exploit the ZeroLogon (CVE-2020-1472) vulnerability to compromise domain controllers and exfiltrate sensitive files. Indicators of compromise and mitigation advice are provided.