Flutterby™! : Slingshot Advanced Persistent Threat

The Slingshot APT FAQ. A Windows exploit kit, in some cases installed via exploited Mikrotik routers, appears to have been part of targeted attacks in the Middle East and Africa from 2012 to the present. The code suggests that it's written by English speaking coders, and that:

The malicious samples investigated by the researchers were marked as ‘version 6.x’, which suggests the threat has existed for a considerable length of time. The development time, skill and cost involved in creating Slingshot’s complex toolset is likely to have been extremely high. Taken together, these clues suggest that the group behind Slingshot is likely to be highly organized and professional and probably state-sponsored.