MSUpdater Trojan And Link To Targeted Attacks

This joint Zscaler and Seculert report describes a targeted campaign delivering a VM-aware remote access Trojan via malicious PDFs that exploit an Adobe vulnerability (CVE-2010-2883). The malware decrypts functionality at runtime, communicates with command-and-control servers over encoded HTTP using Microsoft Update-like filenames and paths to evade detection, and includes indicators and TTPs useful for detection and mitigation.