PowerPoint Presentation

This report analyzes Sednit (APT28/Fancy Bear) operations and tooling used in targeted espionage against diplomatic, government and political entities: it documents phishing-delivered SEDKIT exploit chains, SEDUPLOADER/SEDRECO/XAGENT backdoors, XTUNNEL proxy, the DOWNDELPH Delphi downloader and an advanced bootkit/rootkit persistence stack, includes decrypted configurations, C2/proxy server software, email-based C2 protocols and examples of 0-day usage, and discusses development practices and links to crimeware code.