State-backed hackers breach telcos and organizations in South Asia with custom malware

guest · Oct 18, 2021

State-backed hackers breach telcos with custom malware
October 18, 2021
https://www.bleepingcomputer.com/ne...ed-hackers-breach-telcos-with-custom-malware/

A previously unknown state-sponsored actor is deploying a novel toolset in attacks targeting telecommunication providers and IT firms in South Asia.

The goal of the group — tracked as Harvester by researchers at Symantec who spotted it — is to collect intelligence in highly targeted espionage campaigns focusing on IT, telecom, and government entities.
Click to expand...

Harvester's malicious tools haven't been encountered in the wild before, indicating that this is a threat actor with no connections to known adversaries.

"The Harvester group uses both custom malware and publicly available tools in its attacks, which began in June 2021, with the most recent activity seen in October 2021. Sectors targeted include telecommunications, government, and information technology (IT)," Symantec researchers said.
"The capabilities of the tools, their custom development, and the victims targeted, all suggest that Harvester is a nation-state-backed actor."
Click to expand...

Here’s a summary of the tools used by Harvester operators in their attacks:

Backdoor.Graphon – custom backdoor that uses Microsoft infrastructure for its C&C activity

Custom Downloader – uses Microsoft infrastructure for its C&C activity

Custom Screenshotter – periodically logs screenshots to a file

Cobalt Strike Beacon – uses CloudFront infrastructure for its C&C activity (Cobalt Strike is an off-the-shelf tool that can be used to execute commands, inject other processes, elevate current processes, or impersonate other processes, and upload and download files)

Metasploit – an off-the-shelf modular framework that can be used for a variety of malicious purposes on victim machines, including privilege escalation, screen capture, to set up a persistent backdoor, and more.

Click to expand...

Symantec: Harvester: Nation-state-backed group uses new toolset to target victims in South Asia

Ongoing activity
While we do not have enough evidence yet to attribute Harvester’s activity to a specific nation state, the group’s use of custom backdoors, the extensive steps taken to hide its malicious activity, and its targeting all point to it being a state-sponsored actor. Harvester’s use of legitimate infrastructure to host its C&C servers in order to blend in with normal network traffic is one example of the stealthy steps taken by this actor.

The targeting of organizations in Afghanistan in this campaign is also interesting given the huge upheaval seen in that country recently. The activity carried out by Harvester makes it clear the purpose of this campaign is espionage, which is the typical motivation behind nation-state-backed activity.
Click to expand...

Log in or Sign up

State-backed hackers breach telcos and organizations in South Asia with custom malware

guest Guest

Log in or Sign up

State-backed hackers breach telcos and organizations in South Asia with custom malware

guest Guest

Useful Searches