Tuesday, July 15, 2025
spot_img

Hackers targeting Indian govt via cyber-espionage campaign to steal secret docs: Report

Date:

Share post:

spot_imgspot_img

Shillong, January 17: Researchers have uncovered a highly sophisticated cyber-espionage campaign — ‘Operation RusticWeb’, which the threat actors are using to target various personnel within the Indian government to steal confidential documents, a new report said on Wednesday.

The campaign, first detected in October 2023, uses Rust-based malware and encrypted PowerShell commands, to exfiltrate confidential documents, according to Seqrite, the enterprise arm of global cybersecurity solutions provider, Quick Heal.

“The campaign is initiated with a phishing campaign, targeting government personnel. Threat actors have exploited both, compromised and fake domains, to host malicious payloads and decoy files, ranging from IPR forms to fake domains mimicking prestigious organisations like the Army Welfare Education Society (AWES),” the researchers said.

“The decoy files, designed to lure victims into the malicious web, include forms related to Defence Services Officers Provident Fund and presentations on initiatives with the Ministry of Defence,” they added.

The hackers exfiltrate sensitive documents via a web-based service engine, adding a layer of sophistication to their cyber-espionage tactics.

The first observed infection chain heavily relied on Rust-based payloads, with a malicious shortcut file triggering an elaborate sequence leading to the exfiltration of sensitive data.

The second infection chain, observed in December, deployed maldocs using encrypted PowerShell commands, showcasing the threat actors’ versatility and adaptability, according to the report. The final payload of the cyber-espionage campaign is a Rust-based malware that operates as a data stealer.

As per the researchers, this sophisticated malware not only steals files but also collects system information, ensuring an extensive reconnaissance capability.

The threat actors employ an anonymous public file-sharing engine, OshiUpload, for data exfiltration, avoiding the conventional use of dedicated command-and-control servers. (IANS)

spot_imgspot_img

Related articles

BSF apprehends smuggler along Indo-Bangla border; seizes silver ornaments worth Rs 16.49 lakh

Kolkata, July 14: The Border Security Force (BSF) has apprehended a smuggler and seized 16.71 kg silver ornaments...

Lok Sabha ushers in AI era; adopts multilingual access, digital attendance, real-time transcriptions

New Delhi, July 14: In a landmark move to modernise parliamentary operations, the Lok Sabha Secretariat has unveiled...

3rd Test: Resilient Jadeja brings up 4th successive fifty, drags match into final session

London, July 14: A resilient Ravindra Jadeja brought up his fourth successive half-century in Tests and dragged the...

Centre to issue new guidelines to promote first-time exporters: Piyush Goyal

New Delhi, July 14: The government would soon come out with more guidelines on how new markets, new...