Transparent Tribe APT targets government, military by infecting USB devices

mood · Aug 20, 2020

Transparent Tribe APT targets government, military by infecting USB devices
The hacking group is focused on campaigns in India and Afghanistan
August 20, 2020
https://www.zdnet.com/article/trans...oup-spreads-malware-by-infecting-usb-devices/

Transparent Tribe is involved in campaigns against government and military personnel, revealing a new tool designed to infect USB devices and spread to other systems.

The advanced persistent threat (APT) group, as previously tracked by Proofpoint (.PDF), has been in operation since at least 2013 and has previously been connected to attacks against the Indian government and military.
Recently, the APT has shifted its focus to Afghanistan, however, researchers have documented its presence in close to 30 countries.
Click to expand...

Also known as PROJECTM and MYTHIC LEOPARD, Transparent Tribe is described as a "prolific" group involved in "massive espionage campaigns."

The attack chain starts off in a typical way, via spear-phishing emails.
Fraudulent messages are sent together with malicious Microsoft Office documents containing an embedded macro that deploys the group's main payload, the Crimson Remote Access Trojan (RAT).

Kaspersky says the Trojan is also able to steal files from removable media, key log, and harvest credentials stored in browsers.
Click to expand...

If a USB drive is connected to an infected PC, a copy of the Trojan is quietly installed on the removable drive. The malware will list all directories on a drive and then a copy of the Trojan is buried in the root drive directory. The directory attribute is then changed to "hidden" and a fake Windows directly icon is used to lure victims into clicking on and executing the payload when they attempt to access directories.

"This results in all the actual directories being hidden and replaced with a copy of the malware using the same directory name," the researchers note.
Click to expand...

Kaspersky: Transparent Tribe: Evolution analysis, part 1

Conclusions
Transparent Tribe continues to show high activity against multiple targets. In the last twelve months, we observed a broad campaign against military and diplomatic targets, using extensive infrastructure to support their operations and continuous improvements in their arsenal.

The group continue to invest in their main RAT, Crimson, to perform intelligence activities and spy on sensitive targets. We do not expect any slowdown from this group in the near future and we will continue to monitor their activities.
Click to expand...

mood · Aug 26, 2020

Transparent Tribe: Evolution analysis, part 2
August 26, 2020
https://securelist.com/transparent-tribe-part-2/98233/

Background + Key findings
Transparent Tribe, also known as PROJECTM or MYTHIC LEOPARD, is a highly prolific group whose activities can be traced as far back as 2013. In the last four years, this APT group has never taken time off. They continue to hit their targets, which typically are Indian military and government personnel.
This is the second of two articles written to share the results of our recent investigations into Transparent Tribe. In the previous article, we described the various Crimson RAT components and provided an overview of impacted users. Here are some of the key insights that will be described in this part:

We found a new Android implant used by Transparent Tribe for spying on mobile devices. It was distributed in India disguised as a porn-related app and a fake national COVID-19 tracking app.

New evidence confirms a link between ObliqueRAT and Transparent Tribe.

Click to expand...

Conclusions
Transparent Tribe members are trying to add new tools to extend their operations and infect mobile devices. They are also developing new custom .NET tools like ObliqueRAT, and as observed in the first report, we do not expect this group to slow down any time soon. We will keep monitoring their activities.
Click to expand...

mood · Sep 28, 2020

Researchers Uncover Cyber Espionage Operation Aimed At Indian Army
September 28, 2020
https://thehackernews.com/2020/09/cyberattack-indian-army.html

Cybersecurity researchers uncovered fresh evidence of an ongoing cyberespionage campaign against Indian defense units and armed forces personnel at least since 2019 with an aim to steal sensitive information.

Dubbed "Operation SideCopy" by Indian cybersecurity firm Quick Heal, the attacks have been attributed to an advanced persistent threat (APT) group that has successfully managed to stay under the radar by "copying" the tactics of other threat actors such as the SideWinder.
Exploiting Microsoft Equation Editor Flaw
The campaign's starting point is an email with an embedded malicious attachment — either in the form of a ZIP file containing an LNK file or a Microsoft Word document — that triggers an infection chain via a series of steps to download the final-stage payload.

Aside from identifying three different infection chains, what's notable is the fact that one of them exploited template injection and Microsoft Equation Editor flaw (CVE-2017-11882), a 20-year old memory corruption issue in Microsoft Office [...]
Click to expand...

Possible Links to Transparent Tribe APT
In addition, a few attack chains are also said to have dropped a previously unseen .NET-based RAT (called "Crimson RAT" by Kaspersky researchers) that comes equipped with a wide range of capabilities, including access files, clipboard data, kill processes, and even execute arbitrary commands.

Although the modus operandi of naming DLL files shares similarities with the SideWinder group, the APT's heavy reliance on the open-sourced toolset and an entirely different C2 infrastructure led the researchers to conclude with reasonable confidence that the threat actor is of Pakistani origin — specifically the Transparent Tribe group, which has been recently linked to several attacks targeting the Indian military and government personnel.

"Thus, we suspect that the actor behind this operation is a sub-division under (or part of) Transparent-Tribe APT group and are just copying TTPs of other threat actors to mislead the security community," Quick Heal said.
Click to expand...

Seqrite: Operation SideCopy!

An insight into Transparent Tribe’s sub-division which has been incorrectly attributed for years.

This cyber-operation has been only targeting Indian defence forces and armed forces personnel.

Almost all CnC belongs to Contabo GmbH and server names are similar to machine names found in the Transparent Tribe report.

This threat actor is misleading the security community by copying TTPs that point at Sidewinder APT group.

We suspect this threat actor has links with Transparent Tribe APT group

Click to expand...

mood · Sep 25, 2021

SideCopy (Side Copy), a sub-division of Transparent Tribe
New Malware Targets India's Defense Personnel
Target, Attack Method Point to APT Group SideCopy
September 24, 2021
https://www.databreachtoday.com/new-malware-targets-indias-defense-personnel-a-17609

Researchers have identified a new malware sample that is targeting Indian defense personnel.

The malware code was discovered by an unidentified independent threat hunter who tweets as @s1ckb017. The person tells Information Security Media Group that they detected the malicious file using YARA rules, but declined to offer further details.
Atlanta-based cyber threat intelligence firm Cyble, which studies advanced persistent threat groups extensively, says the target and attack method of the malware point to the work of APT group SideCopy.
Click to expand...

The group, Cyble's research report shows, uses various remote access Trojans and malware to launch campaigns through phishing and delivers malware payloads via email.
The malware file, embedded in a malicious app, has an x86 architecture, with a Windows-based graphical user interface application written in .NET language, Cyble's researchers say

Once downloaded and executed, the malware can perform functions such as device fingerprinting, evasion, command and control, data exfiltration and persistence, he says.

"Considering the composition and behavior of the malware, it appears to have been designed with information theft and espionage as the primary motive," he says.
Click to expand...

SideCopy APT Group
The SideCopy APT group has been known to prefer custom remote access tools as its vector of choice, Medhe says.

"Since this particular multistage malware also has remote access capabilities, there is a possibility that it [SideCopy] may be involved. It is also known to have nation-state affiliations and has targeted India in the past," Medhe says.
The website for the Thailand Computer Emergency Response Team, known as Thai CERT, shows that the SideCopy APT group originates from Pakistan.
Click to expand...

Cyble: APT Group Targets Indian Defense Officials Through Enhanced TTPs

During our routine threat hunting exercise, Cyble Research Labs came across a malware sample posted on Twitter by a researcher who believes that the malware belongs to Transparent Tribe, an Advanced Persistent Threat (APT) Group. Given the nature of the victim and the way they are targeted, we can draw some similarities to the Side Copy APT group.

Both APT groups are known to have mainly targeted India’s Defense and Government sectors in the past. Additionally, both groups have used various other RAT and malware to launch campaigns via multiple modes such as phishing, delivering payload via mail, etc. The malware posted by the researcher on Twitter has used a technique to hide the actual malware in the .vhdx file to avoid any antivirus detection. As per Wikipedia, .vhdx is the successor of VHD (Virtual Hard Disk).
Click to expand...

mood · Nov 17, 2021

SideCopy (Side Copy), a sub-division of Transparent Tribe
Facebook: Pakistani hackers operated a fake app store to target former Afghan officials
November 16, 2021
https://therecord.media/pakistani-h...-app-store-to-target-former-afghan-officials/

Facebook distrupts the operations of one Pakistani and three Syrian hacking groups.

The Pakistani group used Facebook accounts to target officials in the former Afghan government, military, and law enforcement.

The Syrian groups targeted activists, journalists, and minority groups opposing the Assad regime.

Facebook formally linked two groups to two units inside Syria's Air Force intelligence agency.

Click to expand...

The hacking campaign took place between April and August this year and was carried out by a group known as SideCopy, Facebook’s security team said in a report published today.

Facebook security researchers said SideCopy operators created fake profiles on its platform, typically posing as young women, and approached targets with the goal of getting them to click on malicious links.
These links redirected victims to phishing sites that collected login credentials or, in some cases, to fake app stores hosting malware-infected Android apps.
Click to expand...

Facebook said SideCopy typically used malicious apps that posed as chat messaging apps. They either mimicked known brands such as Viber and Signal or posed as new chat apps altogether.

“Among them were apps named HappyChat, HangOn, ChatOut, TrendBanter, SmartSnap, and TeleChat — some of which were in fact functioning chat applications,” said Mike Dvilyanski, Head of Cyber Espionage Investigations, and David Agranovich, Director, Threat Disruption.
These Android apps included remote access trojans. Some apps contained a strain called PJobRAT, while others contained a previously unreported Android malware strain Facebook named Mayhem.
Click to expand...

Meta (Facebook): Taking Action Against Hackers in Pakistan and Syria

We took action against four distinct groups of hackers from Pakistan and Syria.

The malicious activity from Pakistan targeted people in Afghanistan.

Three separate hacking groups from Syria targeted a wide range of people in Syria, including civil society, journalists, humanitarian organizations and the anti-regime military forces. Each of these three hacking groups had links to the Syrian government, including Syria’s Air Force Intelligence.

Click to expand...

mood · Dec 6, 2021

SideCopy (Side Copy), a sub-division of Transparent Tribe
Researchers Detail How Pakistani Hackers Targeting Indian and Afghan Governments
December 3, 2021

A Pakistani threat actor successfully socially engineered a number of ministries in Afghanistan and a shared government computer in India to steal sensitive Google, Twitter, and Facebook credentials from its targets and stealthily obtain access to government portals.

Malwarebytes' latest findings go into detail about the new tactics and tools adopted by the APT group known as SideCopy, which is so-called because of its attempts to mimic the infection chains associated with another group tracked as SideWinder and mislead attribution.

"The lures used by SideCopy APT are usually archive files that have embedded one of these files: LNK, Microsoft Publisher or Trojanized Applications," Malwarebytes researcher Hossein Jazi said, adding the embedded files are tailored to target government and military officials based in Afghanistan and India.
Click to expand...

The cyber espionage campaign observed by Malwarebytes involves the target opening the lure document, leading to the execution of a loader that's used to drop a next-stage remote access trojan called ActionRAT, which is capable of uploading files, executing commands received from a server, and even download more payloads.

Also dropped by the loader is a new information stealer dubbed AuTo Stealer, which is programmed to collect Microsoft Office files, PDF documents, text files, database files, and images before exfiltrating the information to its server over HTTP or TCP.
Click to expand...

Malwarebytes: SideCopy APT: Connecting lures to victims, payloads to infrastructure

Newly observed lures
The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor. Cisco Talos and Seqrite have provided comprehensive reports on this actor’s activities.
Click to expand...

Log in or Sign up

Transparent Tribe APT targets government, military by infecting USB devices

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

Transparent Tribe APT targets government, military by infecting USB devices

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches