DoNot Team Hackers (APT-C-35) Updated its Malware Toolkit with Improved Capabilities

guest · Aug 19, 2022

DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities
August 19, 2022

The Donot Team threat actor has updated its Jaca Windows malware toolkit with improved capabilities, including a revamped stealer module designed to plunder information from Google Chrome and Mozilla Firefox browsers.

The improvements also include a new infection chain that incorporates previously undocumented components to the modular framework, Morphisec researchers Hido Cohen and Arnold Osipov disclosed in a report published last week.
Click to expand...

Also known as APT-C-35 and Viceroy Tiger, the Donot Team is known for setting its sights on defense, diplomatic, government, and military entities in India, Pakistan, Sri Lanka, and Bangladesh, among others at least since 2016.

The latest findings from Morphisec build on a prior report from cybersecurity company ESET, which detailed the adversary's intrusions against military organizations based in South Asia using several versions of its yty malware framework, one of which is Jaca.
Click to expand...

This entails the use of RTF documents that trick users into enabling macros, resulting in the execution of a piece of shellcode injected into memory that, in turn, is orchestrated to download a second-stage shellcode from its command-and-control (C2) server.

The second-stage then acts as a channel to retrieve a DLL file ("pgixedfxglmjirdc.dll" from another remote server, which kick-starts the actual infection by beaconing system information to the C2 server, establishing persistence via a Scheduled Task, and fetching the next-stage DLL ("WavemsMp.dll").

"The main purpose of this stage is to download and execute the modules used to steal the user's information," the researchers noted. "To understand which modules are used in the current infection, the malware communicates with another C2 server."
Click to expand...

Morphisec: APT-C-35 Gets a New Upgrade

The DoNot Team (a.k.a APT-C-35) are advanced persistent threat actors who’ve been active since at least 2016. They’ve targeted many attacks against individuals and organizations in South Asia. DoNot are reported to be the main developers and users of Windows and Android spyware frameworks [1][2][3].

Morphisec Labs has tracked the group’s activity and now exclusively details the latest updates to the group’s Windows framework, a.k.a. YTY, Jaca. In this blog post, we briefly discuss the history of the DoNot team and shed light on updates revealed by the latest samples found in the wild.
Click to expand...

Log in or Sign up

DoNot Team Hackers (APT-C-35) Updated its Malware Toolkit with Improved Capabilities

guest Guest

Log in or Sign up

DoNot Team Hackers (APT-C-35) Updated its Malware Toolkit with Improved Capabilities

guest Guest

Useful Searches