✕
Request a Demo
Rewterz
Rewterz Threat Alert – APT Group Gamaredon – Active IOCs
December 10, 2021
Rewterz
Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
December 10, 2021

Rewterz Threat Alert – PatchWork APT Groups Targeting Pakistani Government Officials – Active Campaign

Severity

High

Analysis Summary

PatchWork, (also known as Mahabusa, White Elephant, hangOver, VICEROY TIGER, and The Dropping Elephant) is an APT that mainly conducts cyber-espionage activities against Asian countries especially against China and Pakistan. Threat actors are now targeting army officials in Pakistan in a series of spear phishing campaign that is impersonating as a Defence Housing Officers Society and dropping a backdoor when enabling the macros with a .Net vulnerability (CVE-2017-87592) a code injection vulnerability which can lead to remote code execution without user interaction if exploited correctly on a vulnerable machine. This vulnerability is generally used to deploy spyware to steal information from the victim’s machine for later gains and use against the victims.

Image

Impact

  • Information theft and espionage

Indicators of Compromise

Filename

  • EOIForm[.]rtf

MD5

  • c82823618b6d13d6540caecb4aef97bb

SHA-256

  • 5b5b1608e6736c7759b1ecf61e756794cf9ef3bb4752c315527bcc675480b6c6

SHA-1

  • 021ea88ee2c5a3dd16c7dc2dd703c0850cc18f83

URL

  • https[:]//karachidha[.]org/docs/EOIForm[.]rtf

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Do not download files attached in untrusted emails.
  • Do not enable macros for untrusted files.
  • Never click on link/attachments sent by unknown senders.