NetTraveler APT Targets Russian, European Interests

Proofpoint reports on a 2016 NetTraveler (TravNet) APT campaign attributed to China that targeted Russian, Mongolian, Belarusian and other European interests via spear-phishing lures (RAR-hosted executables and Word docs exploiting CVE-2012-0158). The report provides technical analysis of NetTraveler (DLL side-loading, config format), builder artifacts (MNKit), detailed infrastructure and IOCs (multiple fake news-like domains, IPs, and SHA256 hashes), and notes links to prior PlugX-related activity.