In addition to deploying traditional versions of what Symantec calls Trojan.Derusbi (i.e. samples that beacon to a hardcoded domain/IP address), this adversary deployed a custom version of this Trojan on perimeter servers. Trojan.Derusbi