Rewterz Threat Alert – APT 21 Targeting Pakistan

Severity

High

Analysis Summary

A new APT organization that has been active since at least 2017 , mainly targeting cyber espionage activities in countries in South Asia . The attack method of this organization is similar to the SideWinder and Bitter organizations of Indian background , but there are essential differences in the details of the attack and the Trojans used. The organization is suspected to have an Indian background, and it mainly targets cyber espionage in government, military, diplomacy, intelligence, atomic energy and universities in South Asia, including Pakistan, Sri Lanka, Maldives and Bangladesh. In spear-phishing attacks, the organization made good use of information related to current political and military targets to produce phishing emails and bait documents, using SFX files disguised as PDF documents , and LNK files disguised as Trojan horse delivery vectors. CVE also used CVE in the early days -2017-11882 Vulnerability spread Trojan.

Impact

Exposure of sensitive information

Indicators of Compromise

From Email

dgpr[.]paknavy[.]gov[.]pk@email[.]com

Hostname

• mail[.]navy[.]mil[.]bd[.]mailupdatenavybdzimbra[.]gov-pk[.]org
• mfamail[.]foreign[.]gov[.]mv[.]mfamailzimbraupdation[.]gov-pk[.]org
• mail[.]paec[.]gov-pk[.]org
• pakcert[.]gov-pk[.]org

MD5

• 791253aded5df197d9db441a6fe2eb4e
• 6a271282fe97322d49e9692891332ad7
• ab88bef8a85aae29dbd6efc3137f227f
• 02e81e2ba998919f1716b881505f2a89
• 6a19e8a202dfdb11bf3aaf9e53f8776a
• 9c9ff19affff6d62e72e618f2b7284da
• 98cc17985510ee4c259447b7c4a2a684
• 3d6aab4e4e055b9c50837c6adc97e060

SHA-256

• 83bac454581249fb89706b61b1b115f0505f76f026870a7ea5507f2e7f9f738c
• 75592b43b8ebf15d880530318dcdecc4901a697015d06ed99e0fff3ce5a90b99
• cfc7070be01d037575248199cc013c0e360aa4fbb33be4e751d6cbf654a062bc
• f8983bc0ed39fc9dd4675eac5a02c7c24b0a9e57c34865bbe9f7117d4ad8321c
• 8fb17be82e6998740e2c17d49012fbd475fcaf8b2ecf8990d996a30b1061cddf
• aefe7ce3ec9328664b375dfb9910b863e086560f990c6d35bf467e2e5b0a992f
• 0e6fadc64284167473bfc8eb22987852a8a8e8cb323548d2e2efdfb26354adb3
• f5026999207600eb4c63c03c2679d46e1a3ec8e25696810d9c7f74721f4d59eb

SHA1

• 178f07d1e8afc9b0fb3150fad234b74b5e53778d
• a9cc72e785cbd46abcdf7cf90f57beca46c29fab
• bf789d83854ca7b149fa9de516024a0d1b1b0aaf

URL

• http[:]//pakcert[.]gov-pk[.]org[:]443/news[.]php
• http[:]//pakcert[.]gov-pk[.]org/CNS_Guidelines_2019[.]zip
• http[:]//pakcert[.]gov-pk[.]org[:]443/login/process[.]php
• http[:]//110[.]10[.]176[.]193[:]4443
• http[:]//pakcert[.]gov-pk[.]org[:]4443/news[.]php
• http[:]//pakcert[.]gov-pk[.]org/shipment[.]rar
• http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta[.]
• http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta[:]
• http[:]//pakcert[.]gov-pk[.]org/poilkjmnb
• http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta
• http[:]//pakcert[.]gov-pk[.]org[:]443/admin/get[.]php
• http[:]//pakcert[.]gov-pk[.]org/zxcvqwerasdf
• http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta
• http[:]//pakcert[.]gov-pk[.]org/mnbvcxz
• http[:]//pakcert[.]gov-pk[.]org[:]443

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.