✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Bitter APT Group – Active IOCs

April 1, 2022
Rewterz

Rewterz Threat Advisory – Multiple IBM Vulnerabilities

April 4, 2022

Rewterz Threat Alert – BabyElephant APT Targeting Bangladesh Navy – Active IOCs

Severity

High

Analysis Summary

The “Baby Elephant” organization is an APT attack organization from the direction of the South Asian subcontinent. The Baby Elephant organization’s attacks can be traced back to July 2017. Its main targets are the governments, military, defense, foreign affairs, nuclear energy, finance, education, telecommunications, and other departments of South Asian countries such as Pakistan, Bangladesh, Sri Lanka, and the Maldives. The recently captured baby elephant organization attack methods are mainly to deliver compressed packages containing exe files containing malicious links to victims. The URL is made in such a way that it would suggest to go to contact.gov-pak.org which will made it look legitimate. ImageImage

Image

BabyElephant Group has been actively Targeting Bangladesh Navy for phishing emails, dropping malicious Word documents which enable macros when downloaded and executed. The malicious file is suspected of being used as an attachment.

Impact

Information theft and espionage

Indicators of Compromise

Domain Name

  • talking-points-9th-bilateral-dialogue[.]netlify[.]app

IP

  • 23[.]94[.]175[.]140

URL

  • https[:]//talking-points-9th-bilateral-dialogue[.]netlify[.]app/mail[.]navy[.]mil[.]bd[.]html

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo