"1.php" Group Intrusion Set Paper

ThreatLabZ reports on the "1.php" Group, an APT-like actor active since at least 2008 that targets China/US relations experts, defense, and geospatial organizations via spearphishing with malicious PDFs or ZIPs that deliver PoisonIvy RAT or similar malware; the group uses web-based C2 checkins (commonly "/1.php?" paths) and sometimes No-IP dynamic DNS domains for C2, and the research provides high-level IOCs while withholding victim-specific details.