DoNot Hacking Workforce Concentrating on Authorities and Army Entities in South Asia

A menace actor with potential hyperlinks to an Indian cybersecurity firm has been nothing if remarkably persistent in its assaults in opposition to navy organizations based mostly in South Asia, together with Bangladesh, Nepal, and Sri Lanka, since no less than September 2020 by deploying totally different variants of its bespoke malware framework.

Slovak cybersecurity agency ESET attributed the extremely focused assault to a hacking group generally known as Donot Workforce. “Donot Workforce has been constantly concentrating on the identical entities with waves of spear-phishing emails with malicious attachments each two to 4 months,” researchers Facundo Muñoz and Matías Porolli mentioned.

Working since no less than 2016, Donot Workforce (often known as APT-C-35 and SectorE02) has been linked to a string of intrusions primarily concentrating on embassies, governments, and navy entities in Bangladesh, Sri Lanka, Pakistan, and Nepal with Home windows and Android malware.

In October 2021, Amnesty Worldwide unearthed proof tying the group’s assault infrastructure to an Indian cybersecurity firm known as Innefu Labs, elevating suspicions that the menace actor could also be promoting the spy ware or providing a hackers-for-hire service to governments of the area.

Whereas it isn’t unusual for APT teams to re-attack a beforehand compromised community by deploying stealthier backdoors to cowl up their tracks, Donot Workforce tries a special tack in that it deploys a number of variants of the malware already in its arsenal.

Delivered through weaponized Microsoft Workplace paperwork, the so-called yty malware framework is a series of middleman downloaders that culminates within the execution of a backdoor, which takes care of retrieving extra elements able to harvesting information, recording keystrokes and screenshots, and deploying reverse shells for distant entry.

ESET dubbed the brand new variants of yty, DarkMusical and Gedit, with telemetry knowledge pointing to assaults from a 3rd variant known as Jaca from March to July 2021. The primary wave of assaults utilizing DarkMusical is claimed to have occurred in June 2021, whereas Gedit-related campaigns have been noticed as early as September 2020, solely to choose up the tempo a yr later.

What’s extra, a fourth set of assaults that occurred between February and March 2021 concentrating on navy organizations in Bangladesh and Sri Lanka leveraged a modified model of Gedit codenamed Henos.

“Donot Workforce makes up for its low sophistication with tenacity,” the researchers concluded. “We anticipate that it’s going to proceed to push on no matter its many setbacks. Solely time will inform if the group evolves its present TTPs and malware.”