Threat Actor Targets Indian Government With Commercial RATs

guest · Sep 27, 2021

Threat Actor Targets Indian Government With Commercial RATs
September 27, 2021
https://www.securityweek.com/threat-actor-targets-indian-government-commercial-rats

Showing similarities with the operations of APT36 (aka Mythic Leopard and Transparent Tribe) and SideCopy, the attacks employed the Netwire and Warzone (AveMaria) RATs, with lures themed around the Kavach two-factor authentication (2FA) application from India's National Informatics Centre (NIC).

APT36 and SideCopy were previously linked to Pakistan and are believed to be state-sponsored threat groups.
Click to expand...

As part of the new campaign, dubbed Operation Armor Piercer, the adversaries were observed using both compromised websites and fake domains for payload hosting, a tactic already associated with APT36.
The attackers delivered to their intended victims various lures in the form of Office documents and archive files, mainly posing as guides and documentation related to the Indian government’s architecture, including Kavach.

The campaign appears to have been ongoing since December 2020, employing Microsoft Office documents carrying malicious VBA macros designed to fetch and execute a malware loader. The final payload is usually a RAT.
Click to expand...

“The use of these RATs benefits an adversary twofold — it makes attribution difficult and saves the effort to create bespoke implants. Beginning in July 2021, however, we observed the deployment of the file enumerators alongside the RATs. This indicates that the attackers are expanding their malware arsenal to target their victims: military and government personnel in India,” Talos concludes.
Click to expand...

Cisco Talos: Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs

Cisco Talos is tracking a campaign targeting government personnel in India using themes and tactics similar to APT36 (aka Mythic Leopard and Transparent Tribe).

This campaign distributes malicious documents and archives to deliver the Netwire and Warzone (AveMaria) RATs.

The lures used in this campaign are predominantly themed around operational documents and guides such as those pertaining to the "Kavach" (hindi for "armor") two-factor authentication (2FA) application operated by India's National Informatics Centre (NIC).

This campaign utilizes compromised websites and fake domains to host malicious payloads, another tactic similar to Transparent Tribe.

Click to expand...

Log in or Sign up

Threat Actor Targets Indian Government With Commercial RATs

guest Guest

Log in or Sign up

Threat Actor Targets Indian Government With Commercial RATs

guest Guest

Useful Searches