Tick__2015__2015-08-20150814-256-CSIR-15005-Stalker-Panda.pdf

A 2015 intelligence report attributes the Stalker Panda APT to a Chinese-affiliated group, outlining its use of several RATs (Elirks, SharpServer, Blogspot, XUni) and a multi-stage C2 architecture leveraging social media and spear-phishing to compromise Windows hosts, with exploits of CVE-2011-0611 and CVE-2014-6332 and persistence via startup-folder shortcuts; the report discusses goals, techniques, and lack of PoC recommendations.