• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – Multiple Cisco Products Security Bypass
August 26, 2021
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
August 27, 2021

Rewterz Threat Alert – BabyElephant APT Targeting Pakistan – Active IOCs

August 27, 2021

Severity

High

Analysis Summary

The “Baby Elephant” organization is an APT attack organization from the direction of the South Asian subcontinent. The Baby Elephant organization’s attacks can be traced back to July 2017. Its main targets are the governments, military, defense, foreign affairs, nuclear energy, finance, education, telecommunications, and other departments of South Asian countries such as Pakistan, Bangladesh, Sri Lanka, and the Maldives. The recently captured baby elephant organization attack methods are mainly to deliver compressed packages containing exe files containing malicious links to victims. The URL is made in such a way that it would suggest to go to contact.gov-pak.org which will made it look legitimate.

Impact

  • Information Theft and Espionage

Indicators of Compromise

Filename

  • Document[.]exe

MD5

  • 2d5f18a8a41c28345a2b7dafecbdadae
  • 1e6ca9c9676793914673c4016afe1ce1

SHA-256

  • ce0d7df28a25d4ddd4c766129f267205fa94d669fbbc47bf1d7662ac1b3b290b
  • b4037f358f329121b7662686242d66baca2abd519278bb350996219158fedf54

SHA1

  • 41ba1a2559a9094904b23e5766f50e7628727cb1
  • 2b41fcc2b2f260296090f565a96ea350260067d3

URL

  • http[:]//contact[.]gov-pak[.]org/

Remediation

  • Block all the threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.