The risk actor referred to as Mysterious Elephant has been noticed utilizing a sophisticated model of malware known as Asynshell.
The assault marketing campaign is claimed to have used Hajj-themed lures to trick victims into executing a malicious payload beneath the guise of a Microsoft Compiled HTML Assist (CHM) file, the Knownsec 404 staff stated in an evaluation printed right this moment.
Mysterious Elephant, which is often known as APT-Ok-47, is a risk actor of South Asian origin that has been lively since at the least 2022, primarily focusing on Pakistani entities.
The group’s ways and tooling have been discovered to share similarities with these of different risk actors working within the areas, resembling SideWinder, Confucius, and Bitter.
In October 2023, the group was linked to a spear-phishing marketing campaign that delivered a backdoor known as ORPCBackdoor as a part of assaults directed towards Pakistan and different international locations.
The precise preliminary entry vector employed by Mysterious Elephant within the newest marketing campaign will not be identified, however it probably entails the usage of phishing emails. The strategy results in the supply of a ZIP archive file that comprises two information: a CHM file that claims to be in regards to the Hajj coverage in 2024 and a hidden executable file.
When the CHM is launched, it is used to show a decoy doc, a reliable PDF file hosted on the federal government of Pakistan’s Ministry of Non secular Affairs and Interfaith Concord web site, whereas the binary is stealthily executed within the background.
A comparatively simple malware, it is designed to determine a cmd shell with a distant server, with Knownsec 404 figuring out practical overlaps with Asyncshell, one other software the risk actor has repeatedly used because the second half of 2023.
As many as 4 completely different variations of Asyncshell have been found up to now, boasting capabilities to execute cmd and PowerShell instructions. Preliminary assault chains distributing the malware have been discovered to leverage the WinRAR safety flaw (CVE-2023-38831, CVSS rating: 7.8) to set off the an infection.
Moreover, subsequent iterations of the malware have transitioned from utilizing TCP to HTTPS for command-and-control (C2) communications, to not point out making use of an up to date assault sequence that employs a Visible Fundamental Script to indicate the decoy doc and launch it by way of a scheduled activity.
“It can be seen that APT-K-47 has frequently used Asyncshell to launch attack activities since 2023, and has gradually upgraded the attack chain and payload code,” the Knownsec 404 staff stated.
“In recent attack activities, this group has cleverly used disguised service requests to control the final shell server address, changing from the fixed C2 of previous versions to the variable C2, which shows the importance APT-k-47 organization internal places on Asyncshell.”
