APT28__2014__Google-Aquarium-Clean.pdf

Peering Into the Aquarium (Google Security Team, Sept 5, 2014) is a detailed technical analysis of the Sofacy first-stage implant and the X-Agent second-stage toolkit used by a sophisticated state-sponsored actor targeting former Soviet republics, NATO members and Western Europe; it documents loader internals, persistence mechanisms, network/C2 protocols (HTTP, SMTP/POP3), air-gapped USB-based exfiltration, sample hashes, domains/IPs, and detection signatures (Yara/Clam).