Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

guest · Oct 20, 2021

Commodity RAT Malware Discovered Targeting Afghanistan and India
October 20, 2021
https://www.technadu.com/commodity-rat-malware-targeting-afghanistan-india/307232/

A RAT that used political and government entities as a facade to target Indian and Afghan organizations was discovered.

It is using a custom enumerator and infector to conduct reconnaissance at the start of their attack campaigns.

The agent’s actions seem to indicate they are a single individual using a paper-only company to conduct a crimeware campaign.

Click to expand...

A threat actor using malicious political- and government-themed websites to target Afghanistan and India. The activities are perpetrated via malicious RTF documents for delivering a number of commodity malware to target systems. They are usually exploiting a Microsoft Office CVE-2017-11882 stack overflow vulnerability which allows for arbitrary code execution.

They usually run their campaign in four phases: [...]
Click to expand...

The actor registered several malicious domains focusing on political and government themes and used them to distribute malware by delivering payloads to targeted devices and systems.

More specifically, they are using malicious RTF documents and PowerShell scripts chain to send out malware to target systems and C#-based downloader binaries for sending out this malware using decoy images to mask their actual code scripts.
They are using the cover of a Pakistani IT firm named “Bunse Technologies.”
Click to expand...

This actor is a perfect example of individual agents using political and humanitarian fronts to ensnare victims via commodity malware. In this particular case, commodity RAT families are the attacking malware of choice for infecting targets. The RATs offer multiple function options which facilitate exerting total control over remote devices.
Click to expand...

Cisco Talos: Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

Cisco Talos recently discovered a threat actor using political and government-themed malicious domains to target entities in India and Afghanistan.

These attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.

The actor also uses a custom file enumerator and infector in their initial reconnaissance phase of the attack.

The actor appears to be a lone wolf using a front company to run a crimeware campaign, possibly to establish initial footholds into high-value targets for future operations or monetary gain.

Click to expand...

Log in or Sign up

Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

guest Guest

Log in or Sign up

Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

guest Guest

Useful Searches