Inside TDrop2: Technical Analysis of new Dark Seoul Malware

Palo Alto Networks recently identified a new campaign targeting the transportation sector in Europe with ties to the Dark Seoul and Operation Troy campaigns that took place in 2013. This new campaign used updated instances of the Tdrop malware family discovered in the Operation Troy campaign. For more information on the new campaign discovered by Unit 42, please refer to our recent blog post.

In this attack, attackers embedded the TDrop2 malware inside a legitimate video software package hos...