Rewterz Threat Alert – APT-C-35 aka Donot Team – Active IOCs

Severity

High

Analysis Summary

The Donot APT – aka APT-C-35 – is a cybercriminal group that mainly targets countries in South Asia, more specifically Pakistan. It has been active since 2012. This APT group has been actively dropping malicious samples and targeting Government users to exfiltrate data. The group has a history of attacking Pakistani government officials and military personnel and has been linked to India. 

They previously targeted Pakistani users with android malware named (StealJob) which was used to target Pakistani android mobile users by Phishing on the name of “Kashmiri Voice” The attackers hunt for confidential information and intellectual property. The hackers’ targets include countries in South Asia, in particular, the state sector of Pakistan.

Also, in July 2022, the threat actor of this APT group used Comodo’s certificate to sign its spyware.

Most recently, this APT gang has incorporated new modules to its Windows spyware framework known as YTY, Jaca. These most recent samples appear to be in use in the wild. The newly added modules include a browser stealer component and a shellcode loader component that examines a fresh reverse shell DLL variation, according to researchers.

The browser stealer component has the ability to steal data from Google Chrome and Mozilla Firefox, including login passwords and browsing history.

In the most recent spear-phishing email attack, the group was discovered employing RTF documents and targeting government departments. When these RTF documents are opened, they send an HTTP GET call to the C2 server, which retrieves a malicious remote template.

The victim is tricked into enabling malicious macros that are then exploited to inject a reverse shell module when a remote template is inserted.

It is recommended to use technologies like network firewalls, EDR, and XDR to detect abnormalities at the entry stage since the group focuses on crucial security gaps that only a few firms may have plugged in.

Impact

• Information Theft and Espionage

Indicators of Compromise

MD5

• 64266fc0f0b37a26e14133ad19b98b7c
• 06adbb4ba31a52cc5c9258bf6d99812c
• 65f904dc7f675b93c2dec927d2b8e58f

SHA-256

• ab5cc990a6f4a196daa73bf655286900e7c669b2a37c32f92cbb54631bc3a565
• 48d5dcbc16d7c1712328ad7c397e564e62b4ec0794a21073c64e1d07c5518bbe
• 4c40bc17b83f1fbcf64a4355a4c1b6bb596b89da3e6c9535107575709c8af770

SHA-1

• e5c3db7587b95d2b5ba91455544f0a63092bd4e6
• 5946ef7d08dfd082d6c81007ec0457b090fc626f
• fb37b21853442fb032d54755d9a0aeb53a034ab6

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs)  in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.