Rewterz Threat Alert – LNK files Targeting Maldives Government

Severity

High

Analysis Summary

A LNK file that targets the Maldives ministry of foreign affairs. The LNK is set to download and execute an HTA file. This is an active campaign going on against Maldives govt with it’s motive still unknown.

Impact

Exposure of sensitive information

Indicators of Compromise

MD5

• dc7b7eb1a9312890bfd8371e51508d00
• 00648c4a077de9608e387164af4b392d

SHA-256

• d928aae8fb1b678be629a3f1bf1ae1accd54a21b25a6f4d8ecf4641cbd4eacf2
• 6616bd8b0919ad2460d5ebd78e7769e03bd21d7c3fdc1c08f537e92c01015721

SHA1

• 08eb7aadd30b782ff6cbf60df23885908f7c4074
• 6d2d29ad5113752eb55921079f5cf54a10d5f9ac

URL

• http[:]//ncit-gov[.]sytes[.]net/image_error[.]hta
• http[:]//foreign-mv[.]sytes[.]net/inauguration_[.]hta
• http[:]//foreign-mv[.]sytes[.]net/command_centre_[.]hta
• http[:]//foreign-mv[.]sytes[.]net/Command_Centre_[.]hta
• http[:]//domain-lk[.]sytes[.]net/pdf_password[.]hta
• http[:]//domain-lk[.]sytes[.]net/pdf_error[.]hta
• http[:]//domain-lk[.]sytes[.]net/password[.]hta
• http[:]//domain-lk[.]sytes[.]net/mndf[.]hta
• http[:]//domain-lk[.]sytes[.]net/leaked_tender_documents[.]hta
• http[:]//domain-lk[.]sytes[.]net/inauguration[.]hta
• http[:]//domain-lk[.]sytes[.]net/command_centre[.]hta
• http[:]//domain-lk[.]sytes[.]net/Pdf_Error[.]hta

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.