ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe
Summary: Unit 42 is tracking a campaign it calls ProjectM, which targets Indian government and military personnel through spear-phishing emails and a watering hole blog named "India News Tribe," using exploits CVE-2010-3333 and CVE-2012-0158 plus macro-enabled Excel files to deliver tools including Crimson, Peppy, DarkComet, Bozok and the Andromeda Trojan. Two command and control domains for Andromeda, winupdater[.]info and ordering-checks[.]com, were registered without WHOIS protection using the address mshoaib.yaseen@gmail.com, and that address and phone number tie back to web design businesses, a Pakistani television actor's website and social media accounts, though Unit 42 says it cannot definitively confirm the individual's involvement.
What you should know: The operators left two domains unprotected in an otherwise WHOIS-shielded infrastructure, and that single registration email connects to a web design business whose servers and domains were reused to host ProjectM payloads - a reminder that one careless registration can expose an entire campaign's supply chain.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2010-3333CVE-2012-0158
- Related
- CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021