Scarcruft APT Group 2018 - 7

SCARCRUFT (associated names Operation Daybreak and Operation Erebus) utilize spear phishing attacks and watering hole attacks as their preferred attack vectors. IoCs include: Flash Exploit CVE-2016-4171, CVE-2016-4117, CVE-2016-1010, CVE-2016-0147 (vulnerability in Microsoft XML Core Services, patched April 2016), modules are signed by an invalid digital certificates listed as “Tencent ...