VICEROY_TIGER__2013__NS-Unveiling-an-Indian-Cyberattack-Infrastructure_FINAL_Web.pdf

Operation HangOver analyzes a multi-year Indian-origin cyberattack infrastructure used for surveillance and corporate espionage, detailing spear-phishing campaigns, CVE-2012-0158 RTF exploits, VB-based Smackdown downloaders, and HangOver/Hanove malware; it maps C2 domains, infrastructure, and domain registrations, and links the activity to real-world targets such as Telenor and other international entities, suggesting a state-sponsored threat actor conducting sustained campaigns.