Researchers at Malwarebytes offer more details on a spear phishing campaign run by a Pakistani threat actor that’s come to be known as “SideCopy.” The campaign was first reported by Facebook earlier this year.
“The SideCopy APT has been actively targeting government and military officials in South Asia,” Malwarebytes says. “The group mainly uses archived files to target victims in spam or spear phishing campaigns. The archive files usually have an embedded lnk, Office or Trojanized application that are used to call mshta to download and execute an hta file. The hta files perform fileless payload execution to deploy one of the RATs associated with this actor such as AllaKore or Action Rat.”
The threat actor is using targeted phishing emails as well as more generic lures to target individuals in Afghanistan and India.
The targeted phishbait is designed to attract specific officials. “These lures are specially crafted and designed to target specific victims,” Malwarebytes says. “We believe this category is very well customized to target government or military officials.”
The generic lures include “romantic lures” with pictures of women to prompt users into opening the malicious attachments. The researchers believe that these emails were “used in spam campaigns to collect emails and credentials to help the actor perform their targeted attacks.”
Malwarebytes adds that the campaign has been successful at stealing information from government targets.
“The SideCopy APT was able to steal several Office documents and databases associated with the Government of Afghanistan,” the researchers write. “As an example, the threat actor exfiltrated Diplomatic Visa and Diplomatic ID cards from the Ministry of Foreign Affairs of Afghanistan database, as well as the Asset Registration and Verification Authority database belonging to the General Director of Administrative Affairs of Government of Afghanistan. They also were able to exfiltrate the ID cards of several Afghani government officials.”
New-school security awareness training can enable your employees to thwart targeted social engineering attacks.
Malwarebytes has the story.
Here's how it works:
