Rewterz Threat Alert – BabyElephant APT Targeting Pakistan – Active IOCs

Severity

High

Analysis Summary

The “Baby Elephant” organization is an APT attack organization from the direction of the South Asian subcontinent. The Baby Elephant organization’s attacks can be traced back to July 2017. Its main targets are the governments, military, defense, foreign affairs, nuclear energy, finance, education, telecommunications, and other departments of South Asian countries such as Pakistan, Bangladesh, Sri Lanka, and the Maldives. The recently captured baby elephant organization attack methods are mainly to deliver compressed packages containing exe files containing malicious links to victims. The URL is made in such a way that it would suggest to go to contact.gov-pak.org which will made it look legitimate.

Impact

• Information Theft and Espionage

Indicators of Compromise

Filename

• Document[.]exe

MD5

• 2d5f18a8a41c28345a2b7dafecbdadae
• 1e6ca9c9676793914673c4016afe1ce1

SHA-256

• ce0d7df28a25d4ddd4c766129f267205fa94d669fbbc47bf1d7662ac1b3b290b
• b4037f358f329121b7662686242d66baca2abd519278bb350996219158fedf54

SHA1

• 41ba1a2559a9094904b23e5766f50e7628727cb1
• 2b41fcc2b2f260296090f565a96ea350260067d3

URL

• http[:]//contact[.]gov-pak[.]org/

Remediation

• Block all the threat indicators at your respective controls.
• Search for IOCs in your environment.