Blackgear__2018__unit42-comnie-continues-target-organizations-east-asia.pdf

Unit 42 analyzes Comnie, a long-running remote backdoor used in targeted espionage against Taiwanese and South Korean organizations; attackers deliver it via malicious Office macros that show decoy documents, retrieve obfuscated C2 data from legitimate third-party services (GitHub/Tumblr/Blogspot), use RC4 for obfuscation and network traffic, achieve persistence via LNK/DLL techniques, and the report includes technical details, scripts, and IoCs for detection and mitigation.