CNACOM Open Source Exploitation via Strategic Web Compromise

This technical report describes the CNACOM campaign: a web-based, targeted exploitation operation that used CVE-2016-0189 (with apparent sandbox escape via CVE-2015-0116) delivered from malicious landing pages to infect visitors from specific Taiwanese government network ranges, ultimately deploying an IXESHE/AES backdoor (linked to APT12/Numbered Panda). The analysis details the infection flow, host fingerprinting logic, persistence mechanism, C2 callback patterns and SSL use, and supplies IOCs including filename, MD5 and a C2 IP.