GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158