Saturday, July 13, 2024
EHA

APT Hackers Targeting Windows platform to Attack Government Institutions & Corporations

Recent research discovered that sophisticated APT hackers group APT-C-36 targeting windows based platform to attackers Government institutes and corporate networks in Colombia.

Researchers believe that the threat actors are operating from South America using weaponized documents to targeting furthermore institutes such as the financial sector, petroleum industry, professional manufacturing, etc.

This APT group continuously targeting since April 2018 using spear-fishing email with a password protected RAR attachment to evade the security detection systems.

Researchers from 360 Threat Intelligence Center flagged almost 29 bait documents, 62 Trojan samples and multiple related malicious domains in total.

Most of the weaponized malicious documents are distributed via malspam emails with Attached MHTML macro based document.

The attachment contains the macro-enabled backdoor to gain a foothold into the target network to make it easier for later attacks.

According to 360 Threat Intelligence Center “Based upon victims’ backgrounds, the attacker is focusing on strategic-level intelligence and may also have motivations to steal business intelligence and intellectual property.”

Meanwhile, attackers masquerade as Colombian government websites also following spear-fishing emails, bait documents are used to compromising the corresponding victims.

Weaponized Malicious Docs

The attacker pretends to come from the National Directorate of Taxes and Customs:

APT hackers

Financial Institution (Banco Agrario)

  • Information and Related Email of the Attacked Institution

The Banco Agrario is a Colombian state financial institution founded in 1999 to provide banking services in the rural sectors.

APT hackers

Spoofed Colombian National Cyber Police

The bait document was spoofed from the Colombian National Cyber Police (caivirtual.policia.gov.co):

APT hackers

Attackers mainly spoofing the original sources make it looks like legitimate for example by masquerading the National Civil Registry to attack the Institute for the Blind, mimics to be the Tax and CustomsAdministration to attack companies with international trade.

In Some cases, Attachment is encrypted and the decryption password left in the body of the mail which is one of the common way that used to avoid detection.

Apart from these attackers using VPN, Proxy to hide their IP address before sending the mail and the real IP will not be visible.

Once the Malicious files get executed then the copied file saved in
the %AppData% directory to save the encrypted log, network information, and system information and finally collected data will be uploaded into C2 server.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles