APT-C-35

Initial Access: The group primarily relies on spear-phishing emails with malicious attachments. These attachments often take the form of RTF or Office documents that leverage exploits (like CVE-2017-11882), remote template injection, or macros to execute malicious code. More recently, the group has shifted to using .LNK files disguised as RTF documents, delivered via spam emails (often within RAR archives). Also, use of the spear phishing is one of the types of phishing attacks.

Execution: Once the initial infection vector is successful, the group uses a combination of PowerShell scripts, shellcode, and DLLs to execute their malware. They employ techniques like process injection (using WinAPI functions like ZwAllocateVirtualMemory, MultiByteToWideChar, and EnumUILanguagesA) and XOR-based decryption routines to evade detection.

Persistence: APT-C-35 achieves persistence through various mechanisms, most commonly by creating scheduled tasks. These tasks are often configured to run the malware at regular intervals (e.g., every 3 or 5 minutes), ensuring continued access even after a system reboot.

Defense Evasion: The group incorporates several techniques to evade security solutions. This includes checking for the presence of security product drivers (e.g., .sys files in C:\Windows\System32\drivers) and modifying the behavior of their malware based on the detected security products and their expiry dates. They also modify the first few bytes of downloaded executables to bypass signature-based detection, restoring them before execution.

Command and Control (C2): APT-C-35 utilizes a multi-stage C2 infrastructure. They often leverage legitimate services like Google Drive to store C2 server addresses. The C2 communication involves encrypted data (using AES-256 with multiple keys and IVs) and Base64 encoding. They employ multiple domains for different purposes within the infection chain. It is important to implement security logging and monitoring to protect from the attacks.

Data Exfiltration: The group's malware is designed to collect a wide range of sensitive information, including files, screenshots, keystrokes, browser data, and system information. This data is typically encrypted and exfiltrated to the C2 server. They have also been observed using legitimate platforms like OneSignal for delivering push notifications to install additional malware on mobile devices.

Modularity: A key feature of APT-C-35's malware is its modular architecture. Functionality is split into separate modules, allowing the group to customize the capabilities of their implants based on the specific target and objectives.

Exploitation of OneSignal: The malware exploits the legitimate OneSignal platform to deliver push notifications. These notifications likely contain phishing links designed to deliver further malware.

Mobile Malware: The group utilizes Android malware, often disguised as legitimate messaging apps or news services. These apps request excessive permissions, allowing them to access contacts, call logs, location data, account information, and external storage files. The Android file system is affected by such malware.

Government and Military Entities: Ministries of Foreign Affairs, embassies, and defense organizations in countries like Pakistan, Sri Lanka, Bangladesh, and other South Asian nations.

Kashmir Region: Individuals and organizations associated with the Kashmir region, reflecting the ongoing geopolitical tensions between India and Pakistan.

Defense Sector Supply Chain: Organizations involved in manufacturing and supplying equipment to the maritime and defense sectors, particularly in Pakistan.

Manufacturing Industry: This includes targeting the manufacturing industry that supports maritime and defense sector.

Other Strategic Industries: While the primary focus is on government and military targets, the group has also been observed targeting IT providers and other industries of strategic interest.

Early Campaigns (2016-2020): These campaigns heavily relied on exploiting CVE-2017-11882 in Microsoft Office, using spear-phishing emails with malicious RTF documents. The malware used during this period included EHDevel and early versions of the YTY framework.

YTY/Jaca Framework Evolution (2020-2021): This period saw the development and deployment of the YTY/Jaca framework, a modular malware platform with components for various espionage activities. Different variants of the framework (Jaca, Gedit, Henos, DarkMusical) were delivered through different file types (PowerPoint, RTF, Excel).

Android Malware Campaigns (2021-Present): APT-C-35 has increasingly incorporated Android malware into its operations. This includes the use of rogue apps disguised as legitimate messaging services (e.g., "Tanzeem," "Tanzeem Update") and news apps (e.g., rogue Kashmir News Service Lite app). These apps exfiltrate sensitive data from compromised devices.

Recent campaigns (2024): It is also found disguised as legitimate messaging apps called "Tanzeem" or "Tanzeem Update."

Targeting Pakistan's Defense Sector (2024): A recent campaign showcased a shift in tactics, utilizing .LNK files disguised as RTF documents to target Pakistan's manufacturing industry, particularly those supporting the maritime and defense sectors. This campaign involved improved encryption and C&C communication techniques.

Khalistan Referendum Attack (2023 - Alleged): There were allegations of Indian hacker involvement in a cyberattack during the Khalistan referendum voting in Australia. While some speculated about APT-C-35's involvement, their past attack patterns suggest this may have been another group or a specially planned operation.

Rogue Google Play Apps (Recent): APT-C-35 has been linked to rogue apps distributed through Google Play, targeting Pakistani users. Examples include iKHfaa VPN and nSure Chat, published under the "SecurITY Industry" developer account. These apps exhibit suspicious data handling practices. It is important to know what is threat intelligence to prevent such attacks.

Strong Email Security: Implement robust email filtering and security gateways to detect and block phishing emails with malicious attachments or links. This includes sandboxing and advanced threat analysis capabilities. One can follow the guide to ensuring security.

Endpoint Detection and Response (EDR): Deploy EDR solutions on all endpoints to monitor for suspicious activity, including process injection, shellcode execution, and unusual network connections.

Vulnerability Management: Maintain a rigorous patch management program to address known vulnerabilities, particularly in Microsoft Office and other commonly targeted software.

Network Segmentation: Segment networks to limit lateral movement and contain breaches.

Security Awareness Training: Educate users about the risks of phishing and social engineering. Train them to identify suspicious emails, attachments, and links.

Threat Intelligence: Leverage threat intelligence feeds and platforms to stay informed about APT-C-35's latest TTPs, indicators of compromise (IOCs), and malware signatures. Also, understand the importance of Indicator of compromise (IOC).

Scheduled Task Auditing: Regularly audit scheduled tasks on systems to identify and remove any unauthorized or suspicious tasks.

PowerShell Restrictions: Restrict the execution of PowerShell scripts for users who do not require it. Implement PowerShell logging and monitoring to detect malicious PowerShell activity.

Behavior-Based Detection: Utilize security solutions that employ behavior-based detection techniques to identify anomalous activity that may indicate a compromise.

Incident Response Plan: Develop and regularly test an incident response plan to ensure a swift and effective response to any potential breaches.

Mobile Device Security: Implement mobile device management (MDM) solutions to enforce security policies on mobile devices. Educate users about the risks of installing apps from untrusted sources.

Moving Target Defense (MTD): Consider MTD, which modifies the runtime environment and makes attacks difficult.

Regular Security Audits: Conduct regular security audits and penetration testing to identify vulnerabilities and weaknesses in the organization's security posture. One should know how to identify vulnerabilities.

Supply Chain Security: Evaluate and monitor the cybersecurity posture of third-party vendors, particularly those in the supply chain, to mitigate the risk of supply chain attacks. Supply chain attack is a major threat.

APT28 (Fancy Bear)

DONOT APT Deploys Malicious Tanzeem Android Apps for Intelligence Gathering

Patchwork APT

Cozy Bear (APT29)

Kimsuky (APT43)