Rewterz Threat Alert – BabyElephant APT Targeting Bangladesh Navy – Active IOCs

Severity

High

Analysis Summary

The “Baby Elephant” organization is an APT attack organization from the direction of the South Asian subcontinent. The Baby Elephant organization’s attacks can be traced back to July 2017. Its main targets are the governments, military, defense, foreign affairs, nuclear energy, finance, education, telecommunications, and other departments of South Asian countries such as Pakistan, Bangladesh, Sri Lanka, and the Maldives. The recently captured baby elephant organization attack methods are mainly to deliver compressed packages containing exe files containing malicious links to victims. The URL is made in such a way that it would suggest to go to contact.gov-pak.org which will made it look legitimate. 

BabyElephant Group has been actively Targeting Bangladesh Navy for phishing emails, dropping malicious Word documents which enable macros when downloaded and executed. The malicious file is suspected of being used as an attachment.

Impact

Information theft and espionage

Indicators of Compromise

Domain Name

• talking-points-9th-bilateral-dialogue[.]netlify[.]app

IP

• 23[.]94[.]175[.]140

URL

• https[:]//talking-points-9th-bilateral-dialogue[.]netlify[.]app/mail[.]navy[.]mil[.]bd[.]html

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.