Thursday, April 25, 2024

Hackers targeting Indian govt via cyber-espionage campaign to steal secret docs: Report


Share post:


Shillong, January 17: Researchers have uncovered a highly sophisticated cyber-espionage campaign — ‘Operation RusticWeb’, which the threat actors are using to target various personnel within the Indian government to steal confidential documents, a new report said on Wednesday.

The campaign, first detected in October 2023, uses Rust-based malware and encrypted PowerShell commands, to exfiltrate confidential documents, according to Seqrite, the enterprise arm of global cybersecurity solutions provider, Quick Heal.

“The campaign is initiated with a phishing campaign, targeting government personnel. Threat actors have exploited both, compromised and fake domains, to host malicious payloads and decoy files, ranging from IPR forms to fake domains mimicking prestigious organisations like the Army Welfare Education Society (AWES),” the researchers said.

“The decoy files, designed to lure victims into the malicious web, include forms related to Defence Services Officers Provident Fund and presentations on initiatives with the Ministry of Defence,” they added.

The hackers exfiltrate sensitive documents via a web-based service engine, adding a layer of sophistication to their cyber-espionage tactics.

The first observed infection chain heavily relied on Rust-based payloads, with a malicious shortcut file triggering an elaborate sequence leading to the exfiltration of sensitive data.

The second infection chain, observed in December, deployed maldocs using encrypted PowerShell commands, showcasing the threat actors’ versatility and adaptability, according to the report. The final payload of the cyber-espionage campaign is a Rust-based malware that operates as a data stealer.

As per the researchers, this sophisticated malware not only steals files but also collects system information, ensuring an extensive reconnaissance capability.

The threat actors employ an anonymous public file-sharing engine, OshiUpload, for data exfiltration, avoiding the conventional use of dedicated command-and-control servers. (IANS)


Related articles

Big B on being honoured with Mangeshkar Award: ‘Abhaar aur mera param saubhagya’

Mumbai, April 25:  Megastar Amitabh Bachchan, who was feted with the Lata Deenanath Mangeshkar Award for his remarkable...

Russia warns NATO nuclear facilities in Poland, says, ‘could become military target’

Moscow, April 25: Russian Deputy Foreign Minister Sergei Ryabkov on Thursday warned that NATO nuclear facilities, if permanently...

Treating politician differently from ordinary criminal will violate Constitution: ED tells SC on CM Kejriwal’s plea

New Delhi, April 25: On Delhi Chief Minister Arvind Kejriwal's plea challenging his arrest, the Enforcement Directorate (ED)...

Congress tied hands of our soldiers, we gave them full freedom to retaliate: PM Modi

Bhopal, April 25: Accusing the Congress party of "tying the hands of soldiers" in the past, Prime Minister...