Forest Global Training Partners

Cyber Risks · Cisco Talos

Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs

Summary: Cisco Talos discovered a campaign targeting government employees and military personnel in the Indian subcontinent with two commercial RAT families, NetwireRAT and WarzoneRAT (Ave Maria), delivered through malicious Office documents and archives posing as guides to Indian government infrastructure such as Kavach. The earliest instance was observed in December 2020, and the attackers hosted payloads on compromised quasi-military and government-related websites, including dsoipalamvihar[.]co[.]in since January 2021 and apsdigicamp[.]com, alongside the fake domain govrn[.]xyz used in July 2021.

Key Takeaway: The attackers compromised a Defence Services Officers' Institute website and an Army Public Schools site to host RAT payloads, trading on the credibility of military-adjacent domains to get targets to open files - and the RATs were left largely unmodified, with effort instead spent on social engineering.

Read the original at Cisco Talos ↗

Topics
Malware
Related