Forest Global Training Partners

Cyber Risks · Cisco Talos

What’s with the shared VBA code between Transparent Tribe and other threat actors?

Summary: Cisco Talos found that VBA code used in malicious Excel and PowerPoint documents by Transparent Tribe, which targets Indian government and military organizations, is also present in samples attributed to Donot and Operation Hangover, which target Pakistani and Chinese organizations. The researchers also identified a set of samples they call "SDuser," found via the PDB path "C:\Users\SDUSER\source\repos" with almost 30 samples uploaded to VirusTotal across seven projects, whose VBA code resembles both Transparent Tribe and Donot code.

What's compelling: Code reuse across groups with opposing target sets means attribution based on a shared VBA dropper can point at the wrong actor, and the SDuser payloads add anti-sandboxing checks that exit unless a USB device history and at least two recently opened files are present, so a clean analysis machine may never see the reverse shell to the attacker's C2.

Read the original at Cisco Talos ↗

Topics
Malware
Related