Analysis Summary

Confucius APT (Advanced Persistent Threat) is a cyber espionage group that has been active since at least 2013. The group's main target is Pakistani and other South Asian countries. The group started using mobile malware to infiltrate its victims before it used desktop malware.

Android surveillanceware tools like SubBird, ChatSpy, and Hornbill have been used by the group to spy on the victims. Pakistan’s military officials, nuclear authorities, and Indian officials located in Kashmir have also been the chief targets of the threat group. Data that can be exfiltrated by the group is Geolocation, Call logs, Device metadata including phone number, IMEI/Android ID, Model and Manufacturer and Android version, Contacts, and even WhatsApp voice notes. The malware used by Confucius can take screenshots, scrape WhatsApp messages and contacts, take photos with the device camera, record the environment, and call audio.

To defend against the Confucius APT group and other APT groups, it is important to follow best practices for cybersecurity, such as keeping software up to date, using strong passwords, and being vigilant against phishing emails and other social engineering attacks. Additionally, organizations can use security tools and services, such as firewalls, intrusion detection systems, and anti-virus software, to help protect against APT attacks.

Impact

• Information Theft
• Cyber Espionage

Indicators of Compromise

MD5

• b327760fb691cc7ede6306239758d1e6
• fb738c7aaa8bc61e5b3833500a75ef34

SHA-256

• 154c26bbbc26165f2d6b7590bc1d7524cb4108c35ff16d727154179e06e4d903
• 5b1e74358963a8fe184d511a1c6d35290173025e4b1287015c9ce0ef3f90ecb2

SHA-1

• 14afc4c00526bbafc0b5a8ac021a3b751e6c6cb0
• 317f6622e778b22b3edb61def0ba417f4f65182c

IP

• 89.47.160.244

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Keep systems up to date and patch regularly.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.