JSAC2020_3_takai_jp.pdf (3 MB)

The JSAC presentation analyzes Operation Bitter Biscuit, a targeted attack campaign reported by multiple security vendors against government, military, defense, and some IT targets. The observed intrusion began with a compressed file attached to a targeted email and abused CVE-2018-20250 in WinRAR or the Microsoft Word add-in folder to launch a dropper. The material details persistence through the Run registry key, first-stage and second-stage backdoors, C2 commands, downloads such as Acrobat.exe, and Bisonal variant comparisons.