India-Linked Threat Actors Utilized Telegram for Coordinating Cyberattacks in Asia

India-Linked Threat Actors Utilized Telegram for Coordinating Cyberattacks in Asia

아리 데니알
Published by: 아리 데니알 on 3월 28, 2024

The cyber intelligence firm Group-IB has revealed a series of phishing attacks carried out by a suspected threat group with ties to Indian nationalists. The attacks targeted a range of government, military, and legal organizations throughout Asia, as reported by Group-IB.

The group behind the attacks, SideWinder aka Hardcore Nationalist (HN2), reportedly targeted more than 60 organizations in countries such as Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka. Government agencies were the primary targets, with 44 being singled out, while only four attacks were aimed at military organizations. Almost half of the attacks were directed at targets in Nepal, which shares a border with India.

“The group has been carrying out cyber espionage attacks against government organizations in the Asia-Pacific region since at least 2012. In June 2022, Group-IB discovered the group’s newest custom tool, SideWinder.AntiBot.Script, which was used in previously documented phishing attacks against Pakistani organizations. SideWinder is notable for its ability to conduct hundreds of espionage operations within a short span of time,” said Group-IB researchers.

According to the cyber analysts, SideWinder utilized Telegram, a widely-used messaging app, to process data from the targeted systems. Telegram has gained popularity among Advanced Persistent Threat (APT) groups and financially-motivated cybercriminals as a command-and-control center or a base of operations, due to its user-friendly interface.

Group-IB reported that SideWinder has updated its toolkit and is now using two new tools:

  • SideWinder.RAT.b — a remote access Trojan
  • SideWinder.StealerPy — a custom information stealer designed to extract data from the victim’s computer.

The tool is capable of extracting a range of sensitive information from the victim’s computer. This includes Google Chrome browsing history, details of saved directories and folders, credentials saved in the browser, metadata, and contents of .txt, .docx, and .pdf files.

It remains unclear whether any of the phishing campaigns were successful. Notably, Group-IB analysts identified two phishing projects that imitated cryptocurrency companies. The increasing interest of SideWinder in cryptocurrency could be related to recent efforts to regulate the crypto market in India.

이 기사가 마음에 드셨나요? 평가해 주세요!
정말 싫습니다 별로 좋아하지 않습니다 괜찮습니다 꽤 좋습니다! 정말 좋습니다!
0 0명의 사용자가 투표
제목
코멘트
피드백을 주셔서 감사합니다