Rewterz Threat Alert – APT 21 Targeting Pakistan

January 17, 2020

Severity

High

Analysis Summary

A new APT organization that has been active since at least 2017 , mainly targeting cyber espionage activities in countries in South Asia . The attack method of this organization is similar to the SideWinder and Bitter organizations of Indian background , but there are essential differences in the details of the attack and the Trojans used. The organization is suspected to have an Indian background, and it mainly targets cyber espionage in government, military, diplomacy, intelligence, atomic energy and universities in South Asia, including Pakistan, Sri Lanka, Maldives and Bangladesh. In spear-phishing attacks, the organization made good use of information related to current political and military targets to produce phishing emails and bait documents, using SFX files disguised as PDF documents , and LNK files disguised as Trojan horse delivery vectors. CVE also used CVE in the early days -2017-11882 Vulnerability spread Trojan.

Impact

Exposure of sensitive information

Indicators of Compromise

From Email

dgpr[.]paknavy[.]gov[.]pk@email[.]com

Hostname

mail[.]navy[.]mil[.]bd[.]mailupdatenavybdzimbra[.]gov-pk[.]org
mfamail[.]foreign[.]gov[.]mv[.]mfamailzimbraupdation[.]gov-pk[.]org
mail[.]paec[.]gov-pk[.]org
pakcert[.]gov-pk[.]org

MD5

791253aded5df197d9db441a6fe2eb4e
6a271282fe97322d49e9692891332ad7
ab88bef8a85aae29dbd6efc3137f227f
02e81e2ba998919f1716b881505f2a89
6a19e8a202dfdb11bf3aaf9e53f8776a
9c9ff19affff6d62e72e618f2b7284da
98cc17985510ee4c259447b7c4a2a684
3d6aab4e4e055b9c50837c6adc97e060

SHA-256

83bac454581249fb89706b61b1b115f0505f76f026870a7ea5507f2e7f9f738c
75592b43b8ebf15d880530318dcdecc4901a697015d06ed99e0fff3ce5a90b99
cfc7070be01d037575248199cc013c0e360aa4fbb33be4e751d6cbf654a062bc
f8983bc0ed39fc9dd4675eac5a02c7c24b0a9e57c34865bbe9f7117d4ad8321c
8fb17be82e6998740e2c17d49012fbd475fcaf8b2ecf8990d996a30b1061cddf
aefe7ce3ec9328664b375dfb9910b863e086560f990c6d35bf467e2e5b0a992f
0e6fadc64284167473bfc8eb22987852a8a8e8cb323548d2e2efdfb26354adb3
f5026999207600eb4c63c03c2679d46e1a3ec8e25696810d9c7f74721f4d59eb

SHA1

178f07d1e8afc9b0fb3150fad234b74b5e53778d
a9cc72e785cbd46abcdf7cf90f57beca46c29fab
bf789d83854ca7b149fa9de516024a0d1b1b0aaf

URL

http[:]//pakcert[.]gov-pk[.]org[:]443/news[.]php
http[:]//pakcert[.]gov-pk[.]org/CNS_Guidelines_2019[.]zip
http[:]//pakcert[.]gov-pk[.]org[:]443/login/process[.]php
http[:]//110[.]10[.]176[.]193[:]4443
http[:]//pakcert[.]gov-pk[.]org[:]4443/news[.]php
http[:]//pakcert[.]gov-pk[.]org/shipment[.]rar
http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta[.]
http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta[:]
http[:]//pakcert[.]gov-pk[.]org/poilkjmnb
http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta
http[:]//pakcert[.]gov-pk[.]org[:]443/admin/get[.]php
http[:]//pakcert[.]gov-pk[.]org/zxcvqwerasdf
http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta
http[:]//pakcert[.]gov-pk[.]org/mnbvcxz
http[:]//pakcert[.]gov-pk[.]org[:]443

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the links/attachments sent by unknown senders.