The Donot Crew menace actor has up to date its Jaca Home windows malware toolkit with improved capabilities, together with a revamped stealer module designed to plunder data from Google Chrome and Mozilla Firefox browsers.
The enhancements additionally embody a brand new an infection chain that comes with beforehand undocumented elements to the modular framework, Morphisec researchers Hido Cohen and Arnold Osipov disclosed in a report printed final week.
Also referred to as APT-C-35 and Viceroy Tiger, the Donot Crew is thought for setting its sights on protection, diplomatic, authorities, and army entities in India, Pakistan, Sri Lanka, and Bangladesh, amongst others at the least since 2016.
Proof unearthed by Amnesty Worldwide in October 2021 linked the group’s assault infrastructure to an Indian cybersecurity firm known as Innefu Labs.
Spear-phishing campaigns containing malicious Microsoft Workplace paperwork are the popular supply pathway for malware, adopted by making the most of macros and different identified vulnerabilities within the productiveness software program to launch the backdoor.
The most recent findings from Morphisec construct on a previous report from cybersecurity firm ESET, which detailed the adversary’s intrusions towards army organizations primarily based in South Asia utilizing a number of variations of its yty malware framework, one among which is Jaca.
This entails using RTF paperwork that trick customers into enabling macros, ensuing within the execution of a chunk of shellcode injected into reminiscence that, in flip, is orchestrated to obtain a second-stage shellcode from its command-and-control (C2) server.
The second-stage then acts as a channel to retrieve a DLL file (“pgixedfxglmjirdc.dll” from one other distant server, which kick-starts the precise an infection by beaconing system data to the C2 server, establishing persistence by way of a Scheduled Job, and fetching the next-stage DLL (“WavemsMp.dll”).
“The primary objective of this stage is to obtain and execute the modules used to steal the consumer’s data,” the researchers famous. “To know which modules are used within the present an infection, the malware communicates with one other C2 server.”
The C2 area, for its half, is obtained by accessing an embedded hyperlink that factors to a Google Drive doc, permitting the malware to entry a configuration that dictates the modules to be downloaded and executed.
These modules develop on the malware’s options and harvest a variety of information similar to keystrokes, screenshots, information, and knowledge saved in net browsers. Additionally, a part of the toolset is a reverse shell module that grants the actor distant entry to the sufferer machine.
The event is one more signal that menace actors are actively adapting their techniques and strategies which can be best in gaining preliminary an infection and sustaining distant entry for prolonged intervals of time.
“Defending towards APTs just like the Donot crew requires a Protection-in-Depth technique that makes use of a number of layers of safety to make sure redundancy if any given layers are breached,” the researchers mentioned.
