Rewterz Threat Alert – Confucius APT group Targeting Pakistan Government – Active IOCs

Severity

High

Analysis Summary

Confucius APT group, an Indian state-sponsored APT group, first started operations in 2013. The group’s main target is Pakistani and other South Asian countries. The group started using mobile malware to infiltrate its victims before it used desktop malware. Android surveillanceware tools like SubBird, ChatSpy, and Hornbill have been used by the group to spy on the victims. Pakistan’s military officials, nuclear authorities, and Indian officials located in Kashmir have also been the chief targets of the threat group. Data that can be exfiltrated by the group is: Geolocation, Call logs, Device metadata including phone number, IMEI/Android ID, Model and Manufacturer and Android version, Contacts, and even WhatsApp voice notes.

The malware used by Confucius is able to take screenshots, scrape WhatsApp messages and contacts, take photos with the device camera, record the environment and call audio. 

Threat actors were recently observed targeting Pakistan Government and Military by delivering a new version of their “Print.dll” trojan with control flow obfuscation, with version ID 3.1.0.

Impact

• Information Theft and Espionage

Indicators of Compromise

IP

142.234.157.195

MD5

c75b8c150054b5ba27cf08c46e13354e
23537d81e9cd285b41185a0e4c3d37c1

SHA-256

66d366fcdc0cef9a6af89a46909c9710bab0192a473f5ac583940093b990c86c
ef76d11453a632920dd5835c0f0f8a317fb187972b0a51cdf8d78560f653d35f

SHA-1

3c596c9408e4f06891131b6d97e653afd1f69452
22046781a123d6fea00dfe4e03fa8922185e09e0

Remediation

• Search for IOCs in your environment.
• Block all threat indicators at your respective controls.
• Do not download documents less attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Keep Systems Up to Date and Patch Regularly
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets