Antlion__2022__Symantec_Antlion-ChineseAPT-Target-Financial-Taiwan_02-03-2022.pdf

Symantec describes an 18+ month Antlion campaign targeting Taiwanese financial and manufacturing organizations using a custom .NET backdoor (xPack), multiple custom loaders and tools, credential dumping (registry and procdump), keylogging, SMB-based file transfers, exploitation (including EternalBlue and CVE-2019-1458), and data staging/exfiltration; the report includes technical analysis, YARA rules and numerous SHA256 IOCs to aid detection and response.