A threat actor based in Pakistan is targeting entities in India and Afghanistan with malware-laden websites, according to researchers at Cisco Talos.
“The threat actor registered multiple domains with political and government themes,” the researchers write. “These domains hosted malware payloads that were distributed to their victims. Their malicious lures also contained themes related to Afghan entities, specifically diplomatic and humanitarian efforts. We assess with high confidence that the threat actor behind these attacks is an individual operating under the guise of a Pakistani IT firm called ‘Bunse Technologies.’ The infection chains consist of malicious RTF documents and PowerShell scripts that distribute malware to victims. We've also observed the usage of C#-based downloader binaries to deploy malware while displaying decoy images to victims to appear legitimate.”
The researchers note that criminals and nation-state actors often use commodity malware in their operations. That’s true in this case as well, as the threat actor used dcRAT and QuasarRAT to target Windows machines, and AndroidRAT to target mobile devices.
“This campaign is a classic example of an individual threat actor employing political, humanitarian and diplomatic themes in a campaign to deliver commodity malware to victims,” Cisco Talos says. “Commodity RAT families are increasingly being used by both crimeware and APT groups to infect their targets. These RATs are packed with multiple functionalities to achieve complete control over the victim's endpoint - from preliminary reconnaissance capabilities to arbitrary command execution and data exfiltration. These families also act as excellent launch pads for deploying additional malware against their victims. Furthermore, these out-of-the-box features enable the attackers to make minimal configuration changes to the RATs taking away the need for a full-fledged development cycle of custom malware by an actor.”
The threat actor also took measures to ensure that their malicious documents would be less likely to be detected.
“The use of a custom file enumerator and infector module by the attackers indicates their intent to proliferate by infecting benign, trusted documents to achieve an even greater degree of infection,” the researchers write.
New-school security awareness training can help your employees thwart targeted phishing attacks.
Cisco Talos has the story.
Here's how it works:
