Transparent Tribe APT targets government, military by infecting USB devices

mood · Aug 20, 2020

Transparent Tribe APT targets government, military by infecting USB devices
The hacking group is focused on campaigns in India and Afghanistan
August 20, 2020
https://www.zdnet.com/article/trans...oup-spreads-malware-by-infecting-usb-devices/

Transparent Tribe is involved in campaigns against government and military personnel, revealing a new tool designed to infect USB devices and spread to other systems.

The advanced persistent threat (APT) group, as previously tracked by Proofpoint (.PDF), has been in operation since at least 2013 and has previously been connected to attacks against the Indian government and military.
Recently, the APT has shifted its focus to Afghanistan, however, researchers have documented its presence in close to 30 countries.
Click to expand...

Also known as PROJECTM and MYTHIC LEOPARD, Transparent Tribe is described as a "prolific" group involved in "massive espionage campaigns."

The attack chain starts off in a typical way, via spear-phishing emails.
Fraudulent messages are sent together with malicious Microsoft Office documents containing an embedded macro that deploys the group's main payload, the Crimson Remote Access Trojan (RAT).

Kaspersky says the Trojan is also able to steal files from removable media, key log, and harvest credentials stored in browsers.
Click to expand...

If a USB drive is connected to an infected PC, a copy of the Trojan is quietly installed on the removable drive. The malware will list all directories on a drive and then a copy of the Trojan is buried in the root drive directory. The directory attribute is then changed to "hidden" and a fake Windows directly icon is used to lure victims into clicking on and executing the payload when they attempt to access directories.

"This results in all the actual directories being hidden and replaced with a copy of the malware using the same directory name," the researchers note.
Click to expand...

Kaspersky: Transparent Tribe: Evolution analysis, part 1

Conclusions
Transparent Tribe continues to show high activity against multiple targets. In the last twelve months, we observed a broad campaign against military and diplomatic targets, using extensive infrastructure to support their operations and continuous improvements in their arsenal.

The group continue to invest in their main RAT, Crimson, to perform intelligence activities and spy on sensitive targets. We do not expect any slowdown from this group in the near future and we will continue to monitor their activities.
Click to expand...

mood · Aug 26, 2020

Transparent Tribe: Evolution analysis, part 2
August 26, 2020
https://securelist.com/transparent-tribe-part-2/98233/

Background + Key findings
Transparent Tribe, also known as PROJECTM or MYTHIC LEOPARD, is a highly prolific group whose activities can be traced as far back as 2013. In the last four years, this APT group has never taken time off. They continue to hit their targets, which typically are Indian military and government personnel.
This is the second of two articles written to share the results of our recent investigations into Transparent Tribe. In the previous article, we described the various Crimson RAT components and provided an overview of impacted users. Here are some of the key insights that will be described in this part:

We found a new Android implant used by Transparent Tribe for spying on mobile devices. It was distributed in India disguised as a porn-related app and a fake national COVID-19 tracking app.

New evidence confirms a link between ObliqueRAT and Transparent Tribe.

Click to expand...

Conclusions
Transparent Tribe members are trying to add new tools to extend their operations and infect mobile devices. They are also developing new custom .NET tools like ObliqueRAT, and as observed in the first report, we do not expect this group to slow down any time soon. We will keep monitoring their activities.
Click to expand...

mood · Sep 28, 2020

Researchers Uncover Cyber Espionage Operation Aimed At Indian Army
September 28, 2020
https://thehackernews.com/2020/09/cyberattack-indian-army.html

Cybersecurity researchers uncovered fresh evidence of an ongoing cyberespionage campaign against Indian defense units and armed forces personnel at least since 2019 with an aim to steal sensitive information.

Dubbed "Operation SideCopy" by Indian cybersecurity firm Quick Heal, the attacks have been attributed to an advanced persistent threat (APT) group that has successfully managed to stay under the radar by "copying" the tactics of other threat actors such as the SideWinder.
Exploiting Microsoft Equation Editor Flaw
The campaign's starting point is an email with an embedded malicious attachment — either in the form of a ZIP file containing an LNK file or a Microsoft Word document — that triggers an infection chain via a series of steps to download the final-stage payload.

Aside from identifying three different infection chains, what's notable is the fact that one of them exploited template injection and Microsoft Equation Editor flaw (CVE-2017-11882), a 20-year old memory corruption issue in Microsoft Office [...]
Click to expand...

Possible Links to Transparent Tribe APT
In addition, a few attack chains are also said to have dropped a previously unseen .NET-based RAT (called "Crimson RAT" by Kaspersky researchers) that comes equipped with a wide range of capabilities, including access files, clipboard data, kill processes, and even execute arbitrary commands.

Although the modus operandi of naming DLL files shares similarities with the SideWinder group, the APT's heavy reliance on the open-sourced toolset and an entirely different C2 infrastructure led the researchers to conclude with reasonable confidence that the threat actor is of Pakistani origin — specifically the Transparent Tribe group, which has been recently linked to several attacks targeting the Indian military and government personnel.

"Thus, we suspect that the actor behind this operation is a sub-division under (or part of) Transparent-Tribe APT group and are just copying TTPs of other threat actors to mislead the security community," Quick Heal said.
Click to expand...

Seqrite: Operation SideCopy!

An insight into Transparent Tribe’s sub-division which has been incorrectly attributed for years.

This cyber-operation has been only targeting Indian defence forces and armed forces personnel.

Almost all CnC belongs to Contabo GmbH and server names are similar to machine names found in the Transparent Tribe report.

This threat actor is misleading the security community by copying TTPs that point at Sidewinder APT group.

We suspect this threat actor has links with Transparent Tribe APT group

Click to expand...

Log in or Sign up

Transparent Tribe APT targets government, military by infecting USB devices

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

Transparent Tribe APT targets government, military by infecting USB devices

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches