Increased activity from APT36, a Pakistan-linked Cyber Threat actor

guest · Jul 10, 2020

Indian Defense Organizations Under Attack By APT36
July 8, 2020
https://exchange.xforce.ibmcloud.com/collection/3b275f81dbde1d574f76928d2c4d620d

Indian governmental defense organizations and their personnel are the latest victims of APT36, a Seqrite article reports.

Fake profiles of attractive women are used as bait in honey traps set up by APT36. Those that visit the fake profiles receive emails with attachments or are engaged in conversations over messaging applications where they are presented with links to malware or the malware itself.

Once the victim opens the attachment, Crimson RAT is subsequently installed on their system. Crimson RAT is known for stealing data and reporting it back to its command and control servers. This campaign has been labeled "Operation Honey Pot" by Seqrite.
Click to expand...

Seqrite: Operation ‘Honey Trap’: APT36 Targets Defense Organizations in India

In the last 3 months, we have noticed increased activity from APT36, a Pakistan-linked Cyber Threat actor. The target this time are personnel belonging to defence organizations & other Government organizations in India.
Campaign Overview
This campaign continues to use two separate infection chains. These two infection techniques of APT36 have remained the same in the past couple of years.

In the first chain, a spear-phishing email has a macro loaded document as an attachment. This document is responsible to execute a dropper module that starts the Crimson RAT tool to perform malicious activity.
In the second chain, a spear-phishing email attachment directly contains a dropper module within a zip file.
Click to expand...

Crimson RAT
Crimson RAT remains a popular arsenal on APT36 group.
Conclusion
It is a well-established fact, that APT36 targets defence and other critical sector organizations.
However, in this campaign, interestingly, some of the targeted entities belong to organizations based in the eastern states in India! In last one year, this is the second instance where we saw APT36 targeting organizations of interest to India’s eastern neighbour
Click to expand...

Log in or Sign up

Increased activity from APT36, a Pakistan-linked Cyber Threat actor

guest Guest

Log in or Sign up

Increased activity from APT36, a Pakistan-linked Cyber Threat actor

guest Guest

Useful Searches