Rewterz Threat Alert – APT C-35 (Donot Team) Template Injection

Severity

High

Analysis Summary

APT C-35 aka (Donot Team) has been actively dropping malicious files for template injection. The group has a history of attacking Pakistani government officials and military personnel and has been linked to India. They 
previously targeted Pakistani users with android malware named (StealJob) was used to target Pakistani android mobile users by Phishing on the name of “Kashmiri Voice” The attackers hunt for confidential information and intellectual property. The hackers’ targets include countries in South Asia, in particular, state sector of Pakistan.

Impact

Remote code execution

Indicators of Compromise

Filename

• IR-80-FR04[.]docx

MD5

• 59edfb504e890a8cd54a8d5ceba31fff

SHA-256

• 2a811e51b0afdadfd7cfc7e7097657a5116bc1c81fe8042b70b5d63043b1a04b

SHA1

• b03acf0ecf4ada043795af1412eb4b6e24c2a65f

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.