Rewterz Threat Alert – Confucius APT group Targeting Pakistan Government – Active IOCs

Severity

High

Analysis Summary

Confucius APT (Advanced Persistent Threat) is a cyber espionage group that has been active since at least 2013.The group’s main target is Pakistani and other South Asian countries. The group started using mobile malware to infiltrate its victims before it used desktop malware. Android surveillanceware tools like SubBird, ChatSpy, and Hornbill have been used by the group to spy on the victims. Pakistan’s military officials, nuclear authorities, and Indian officials located in Kashmir have also been the chief targets of the threat group. Data that can be exfiltrated by the group is: Geolocation, Call logs, Device metadata including phone number, IMEI/Android ID, Model and Manufacturer and Android version, Contacts, and even WhatsApp voice notes. The malware used by Confucius can take screenshots, scrape WhatsApp messages and contacts, take photos with the device camera, record the environment and call audio. 

Most recently the group was observed targeting Pakistan Government with a lure related to Prime Minister’s Relief fund for Turkiye Earthquake victims.

To defend against the Confucius APT group and other APT groups, it is important to follow best practices for cybersecurity, such as keeping software up to date, using strong passwords, and being vigilant against phishing emails and other social engineering attacks. Additionally, organizations can use security tools and services, such as firewalls, intrusion detection systems, and anti-virus software, to help protect against APT attacks.

Impact

• Information Theft and Espionage

Indicators of Compromise

MD5

• 89fd996f81c46ced545c36599f8ebc0a

SHA-256

• 716298589ab48b187c127e9dbe47dd78487d0e4fd1841bf09d7e45027a23ac06

SHA-1

• 573902ec91884f574423a4103c311678783c4789

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Keep Systems Up to Date and Patch Regularly
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets