✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – APT group Kimsuky – Active IOCs

June 7, 2021
Rewterz

Rewterz Informative Update – Malware Can Use This Trick to Bypass Ransomware Defense in Antivirus Solutions

June 8, 2021

Rewterz Threat Alert – APT C-23 aka AridViper Active in the Region – Active IOCs

Severity

High

Analysis Summary

APT C-23 also known as AridViper and Desert Falcon is active in the region targeting different sectors with their malicious documents. The group’s discovery came around March 2017 with their main targets emerged as the Middle East. The group has previously faked an android app to deploy Android/SpyC23.A mainly for spying, including reading notifications from messaging apps, call recording and screen recording, and with new stealth features, such as dismissing notifications from built-in Android security apps.

New sample seems used by APT-C-23. Once it gets executed, a document relating to information about EgyptAir is shown to confuse the victim and meanwhile RAT is executed to perform remote control. 
 

Image

Impact

  • Unauthorized access of victim’s machine
  • Information theft and espionage
  • Exposure of sensitive data

Indicators of Compromise

Filename

  • AuditPolicy[.]exe

MD5

  • e38c06f83a5c1b0a4f82c965a4c78654

SHA-256

  • 823bf27b1e559d6607f5224ab99de1c83bb5d36e2ed0e6644d551e94ec45d248

SHA-1

  • 78c945e7277f6b7549929442705aeb6ec4eb444a

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on links/attachments sent by unknown senders.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo