• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – GandCrab Malware Delivered via Malspam Campaign
January 17, 2020
Rewterz Threat Alert – Cloud based python RAT targeting Middle Eastern countries
January 17, 2020

Rewterz Threat Alert – APT 21 Targeting Pakistan

January 17, 2020

Severity

High

Analysis Summary

A new APT organization that has been active since at least 2017 , mainly targeting cyber espionage activities in countries in South Asia . The attack method of this organization is similar to the SideWinder and Bitter organizations of Indian background , but there are essential differences in the details of the attack and the Trojans used. The organization is suspected to have an Indian background, and it mainly targets cyber espionage in government, military, diplomacy, intelligence, atomic energy and universities in South Asia, including Pakistan, Sri Lanka, Maldives and Bangladesh. In spear-phishing attacks, the organization made good use of information related to current political and military targets to produce phishing emails and bait documents, using SFX files disguised as PDF documents , and LNK files disguised as Trojan horse delivery vectors. CVE also used CVE in the early days -2017-11882 Vulnerability spread Trojan.

Impact

Exposure of sensitive information

Indicators of Compromise

From Email

dgpr[.]paknavy[.]gov[.]pk@email[.]com

Hostname

  • mail[.]navy[.]mil[.]bd[.]mailupdatenavybdzimbra[.]gov-pk[.]org
  • mfamail[.]foreign[.]gov[.]mv[.]mfamailzimbraupdation[.]gov-pk[.]org
  • mail[.]paec[.]gov-pk[.]org
  • pakcert[.]gov-pk[.]org

MD5

  • 791253aded5df197d9db441a6fe2eb4e
  • 6a271282fe97322d49e9692891332ad7
  • ab88bef8a85aae29dbd6efc3137f227f
  • 02e81e2ba998919f1716b881505f2a89
  • 6a19e8a202dfdb11bf3aaf9e53f8776a
  • 9c9ff19affff6d62e72e618f2b7284da
  • 98cc17985510ee4c259447b7c4a2a684
  • 3d6aab4e4e055b9c50837c6adc97e060

SHA-256

  • 83bac454581249fb89706b61b1b115f0505f76f026870a7ea5507f2e7f9f738c
  • 75592b43b8ebf15d880530318dcdecc4901a697015d06ed99e0fff3ce5a90b99
  • cfc7070be01d037575248199cc013c0e360aa4fbb33be4e751d6cbf654a062bc
  • f8983bc0ed39fc9dd4675eac5a02c7c24b0a9e57c34865bbe9f7117d4ad8321c
  • 8fb17be82e6998740e2c17d49012fbd475fcaf8b2ecf8990d996a30b1061cddf
  • aefe7ce3ec9328664b375dfb9910b863e086560f990c6d35bf467e2e5b0a992f
  • 0e6fadc64284167473bfc8eb22987852a8a8e8cb323548d2e2efdfb26354adb3
  • f5026999207600eb4c63c03c2679d46e1a3ec8e25696810d9c7f74721f4d59eb

SHA1

  • 178f07d1e8afc9b0fb3150fad234b74b5e53778d
  • a9cc72e785cbd46abcdf7cf90f57beca46c29fab
  • bf789d83854ca7b149fa9de516024a0d1b1b0aaf

URL

  • http[:]//pakcert[.]gov-pk[.]org[:]443/news[.]php
  • http[:]//pakcert[.]gov-pk[.]org/CNS_Guidelines_2019[.]zip
  • http[:]//pakcert[.]gov-pk[.]org[:]443/login/process[.]php
  • http[:]//110[.]10[.]176[.]193[:]4443
  • http[:]//pakcert[.]gov-pk[.]org[:]4443/news[.]php
  • http[:]//pakcert[.]gov-pk[.]org/shipment[.]rar
  • http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta[.]
  • http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta[:]
  • http[:]//pakcert[.]gov-pk[.]org/poilkjmnb
  • http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta
  • http[:]//pakcert[.]gov-pk[.]org[:]443/admin/get[.]php
  • http[:]//pakcert[.]gov-pk[.]org/zxcvqwerasdf
  • http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta
  • http[:]//pakcert[.]gov-pk[.]org/mnbvcxz
  • http[:]//pakcert[.]gov-pk[.]org[:]443

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.