APT group`s malware retrieved C&C IP addresses from Microsoft`s TechNet portal

A China-based APT group has been using #microsoft’s TechNet web portal to host encoded Command and Control IP addresses for its BLACKCOFFEE #malware, FireEye researchers have revealed. “While other groups have used legitimate websites to host C&C IP addresses, APT17 took the additional step of embedding encoded C&C IP addresses for the BLACKCOFFEE malware in […]