Rewterz Threat Alert – Confucius APT Threat Actors – Active IOCs

Severity

High

Analysis Summary

Analysis Summary

Confucius APT (Advanced Persistent Threat) is a cyber espionage group that has been active since at least 2013.The group’s main target is Pakistani and other South Asian countries. The group started using mobile malware to infiltrate its victims before it used desktop malware. Android surveillanceware tools like SubBird, ChatSpy, and Hornbill have been used by the group to spy on the victims. Pakistan’s military officials, nuclear authorities, and Indian officials located in Kashmir have also been the chief targets of the threat group. Data that can be exfiltrated by the group is: Geolocation, Call logs, Device metadata including phone number, IMEI/Android ID, Model and Manufacturer and Android version, Contacts, and even WhatsApp voice notes. The malware used by Confucius can take screenshots, scrape WhatsApp messages and contacts, take photos with the device camera, record the environment and call audio. 

To defend against the Confucius APT group and other APT groups, it is important to follow best practices for cybersecurity, such as keeping software up to date, using strong passwords, and being vigilant against phishing emails and other social engineering attacks. Additionally, organizations can use security tools and services, such as firewalls, intrusion detection systems, and anti-virus software, to help protect against APT attacks.

Impact

• Information Theft and Espionage

Indicators of Compromise

MD5

• 719c5203fedbf9715e6803030a9c9266
• c3c25be2a656929411eaa4b4dbca7599

SHA-256

• 4e7334946dd67b8cf6e6bcaa5cda154f33460af28ffbb9258cc8252805d32812
• 9b3d01dd457b4eeae6712df54c7ef96312f56cd0115612d0d5aece654fc6bc61

SHA-1

• ca9e9195b9cdda76c3c10e0e87f0a9832a26a9f2
• 5b0b5c9c800f45085dcb199b1bcce4a4a8c8baf1

Remediation

• Search for IOCs in your environment.
• Block all threat indicators at your respective controls.
• Do not download documents less attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Keep Systems Up to Date and Patch Regularly
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets