cfile4.uf996DB6365A7253830AD55C.pdf (1 MB)

ESTsecurity analyzed the Arabian Night operation using a malicious Word document named Hanssak System that relied on social engineering to prompt macro execution. When macros ran, the document XOR-decoded and dropped a decoy Kuipernet installation survey document and a svchost.exe bot that copied itself as java.exe, added JavaUpdate persistence, collected host and system information, and contacted four C2 IP addresses located in South Korea. The bot supported commands for disk and process discovery, file listing and theft, program execution, C2 reconfiguration, communication checks, timestamp changes, and destructive file operations. Metadata and code similarities linked the sinbad-authored document set to earlier IsOne-related Shadow Play material, including similar macro structure, CMD string construction, and forensic-resistant file deletion behavior.