Cyber Threat

Hackers Exploit Religious Pilgrimage to Deploy Sophisticated Malware Attack

ClickControl

Author

December 05, 2024

Published

Reading

Hackers Exploit Religious Pilgrimage to Deploy Sophisticated Malware Attack

Mysterious Elephant (also known as APT-K-47), a South Asian threat actor, has launched a sophisticated cyber attack campaign using an upgraded version of the Asyncshell malware. Key points:

Attack Details:
– Uses Hajj-themed bait to deceive victims
– Delivers malware through Microsoft CHM files
– Targets primarily Pakistani entities
– Active since 2022

Technical Aspects:
– Attack delivers two files:
1. A CHM file (appearing as 2024 Hajj policy information)
2. A hidden executable
– Shows legitimate Pakistan Ministry document as decoy
– Executes malicious payload in background
– Uses cmd shell to connect with remote server

Malware Evolution:
– Four versions of Asyncshell identified
– Capabilities include cmd and PowerShell command execution
– Shifted from TCP to HTTPS for C2 communications
– Exploits WinRAR vulnerability (CVE-2023-38831)
– Implements variable C2 addresses instead of fixed ones

The group shares similarities with other regional threat actors (SideWinder, Confucius, and Bitter) and demonstrates increasing sophistication in their attack methodologies and tool development.

This summary maintains the critical information while presenting it in a more structured and accessible format.

Keywords: Mysterious Elephant, APT-K-47, South Asian threat actor, cyber attack campaign, Asyncshell malware, Hajj-themed attacks, Microsoft CHM files, Pakistani cybersecurity, malware attacks, cyber threat intelligence, APT groups, malicious payload, command and control, C2 communications, WinRAR vulnerability, CVE-2023-38831, SideWinder APT, Confucius APT, Bitter APT, cybersecurity threats, advanced persistent threats, malware evolution, cyber espionage, threat actor groups, South Asian cybersecurity, targeted attacks, malware analysis, cyber deception, PowerShell attacks, cmd shell exploitation, HTTPS communication, TCP protocols, cyber attack methodology

Share This Article