Summary: A South Asian APT has been persistently targeting Sri Lanka, Bangladesh, Pakistan, and Turkey. This post walks through infrastructure and malware pivots to expose novel tooling that compromised the phones of military-adjacent folks.
Recently a zip was detected named Coordination of the Chief of Army Staff's Visit to China.zip. An archive with this theme sticks out like a sore thumb to threat analysts.
Indeed, upon examining the compressed PDF, it was an obviously targeted phish.
|
Phish lure |
Phish decoy |
|---|---|
Figure 1: Top level PDF phish |
Figure 2: Decoy shown post cred theft |
The first pivot an analyst makes is to look for similarly named documents, or that have similar embedded urls, which yielded the results below:
|
Doc |
md5 |
First stage |
Second stage |
|---|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 3: IDEF-themed phishing page, targeting Turks
The javascript that attempted to block “source viewing”, as seen in the image above, appeared unique. Looking at other phishing pages that contained the same blocker yielded quick results. The folks at Hunt IO regularly blog about an adjacent set of activity, as well as OSINT analysts Demon and Nouman.
|
Phishing domain |
Spoof/Theme |
|---|---|
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Government of Bangladesh |
|
|
Bangladesh Army |
|
|
Bangladesh Air Force |
|
|
Bangladesh Computer Council (BCC) |
|
|
Bangladesh Army |
|
|
Roketsans (Turkey) |
|
|
Roketsans (Turkey) |
|
|
Embassy of Italy |
|
|
Gulf Countries |
|
|
IDEF (International Defence Industry Fair) |
|
|
IDEF (International Defence Industry Fair) |
|
|
AFD Government of Bangladesh |
|
|
Aselsan (Turkish company) |
|
|
Bangladesh Air Force |
|
|
Bangladesh Air Force |
|
|
BOF Government of Bangladesh |
|
|
Directorate General of Forces Intelligence (DGFI) |
|
|
Ministry of Defence (MOD) |
|
|
Ministry of Defence (MOD) |
|
|
Ministry of Defence (MOD) |
|
|
Bangladesh Air Force |
|
|
Bangladesh Computer Council (BCC) |
|
|
Bangladesh Army |
|
|
Bangladesh Army |
|
|
Bangladesh Police |
|
|
|
Reexamining our previous set of c2s, there was another error message that we could key off. The landing page on the domain was reused, which hard coded a particular unix timestamp, corresponding to March 28th, 2025.
Figure 4: Landing page with hard coded timestamp
This landing page was similarly seen on many other similar looking domains:
|
Phishing domain |
Spoof/Theme |
|---|---|
|
|
AFD Government of Bangladesh |
|
|
Assan Group (Turkish company) |
|
|
Bangladesh Computer Council (BCC) |
|
|
Bangladesh Navy |
|
|
Bangladesh Police |
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Directorate General of Defence Purchase (DGDP) |
|
|
Directorate General of Forces Intelligence (DGFI) |
|
|
Government of Bangladesh |
|
|
Government of Bangladesh |
|
|
Ministry of Foreign Affairs (MOFA) Pakistan |
|
|
Ministry of Foreign Affairs (MOFA) Pakistan |
|
|
|
|
|
Paragon (Pakistan-based company) |
|
|
Profen |
|
|
Timgos Savunma (Turkish company) |
|
|
|
|
|
|
|
|
Bangladesh Air Force mail |
|
|
Bangladesh Air Force |
|
|
Bangladesh DGDP |
|
|
Bangladesh DGDP |
|
|
Bangladesh DGDP |
|
|
Bangladesh DGDP |
|
|
Bangladesh government |
|
|
Bangladesh government |
|
|
Bangladesh police |
|
|
Bangladesh High Commission |
|
|
BMS Defence |
|
|
|
|
|
|
|
|
|
|
|
Nepal government |
|
|
Profen login |
|
|
|
|
|
|
|
|
|
|
|
|
Pivoting on updatemind52.com, which was also mentioned by Twitter user AiTM, we can see an APK file hosted at updatemind52.com/Love_Chat.apk. This is a mod of an open source Android RAT, Rafel Rat, the source of which can be reviewed here.
|
|
|
Below, we can see the decompiled APK file uploading various document types from the device to the c2.
Figure 5: h/t to dex2jar
aHR0cHM6Ly9xdWlja2hlbHBzb2x2ZS5jb20vcHVibGljL2NvbW1hbmRzLnBocA== decodes to the c2, https://quickhelpsolve.com/public/commands.php, which we saw used by this actor for credential phishing. That same domain was used in the malicious APK b8eda465ffbc197d80a9ce7ab785f07a, and with other simple pivots, we can find a cluster of other APK.
|
App name |
MD5 |
C2 |
Decoy |
|---|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 6: obligatory non-ida ida screenshot showing how the decoy was launched
The apps themselves are standard infostealers, as well as a remote shell to execute arbitrary commands. Sample permissions and actions include, but are not limited to, ADD_DEVICE_ADMIN, READ_EXTERNAL_STORAGE, MANAGE_APP_ALL_FILES_ACCESS_PERMISSION, READ_CONTACTS, READ_MEDIA_VIDEO etc.
The landing pages and decoys are similar to what one would expect. A notable Pakistani dating service was a key pivot point to find other related samples.
Figure 7: “ChatMe” decoy |
Figure 8: “Love Chat” decoy |
Figure 9: voting.apk decoy |
From the above play-googyle.com and playservicess.com, we can see a crossover in the email registrant from the whois scanner in the free community version of SilentPush. This registrant noraramly30121982@yahoo.com was seen on another similar domain in '24 mailservicess.com. Additionally, this email address, except on gmail (noraramly30121982@gmail.com) was used to register mailserver-lk.com which has been used prolifically to phish, and has been catalogued by ThreatBook, as well as our own Labs account. As always, Maltrail is a great resource for aggregating indicators from the OSINT community.
Figure 10: SilentPush free WHOIS scanner
The kutcat c2 is a modded version of Rafel-rat, notably with the credits from the original author removed from the panel. The c2 has the ability to send down arbitrary commands to compromised phones. If one has good dns telem, gj3nyrs9jqrslv5hbej92406cxin6c.burpcollaborator.net may be a useful indicator. kutcat-rat.com was also mentioned by Twitter user MHT.
Figure 11: Commands sent to selected compromised phones
Below one can see the c2 panel, which was publicly available and indexed by google, with device information, and was disabled prior to this blog post. On the server was a plethora of stolen content, including documents, raw SMS, and contact lists. In the content, it was abundantly clear that many of the victims were members of the military of multiple South Asian countries, as well as close contacts, based on phone address books that only included ranks and duty stations.
Figure 12: C2 panel |
Figure 13: C2 panel |
Figure 14: Sample of stolen SMS |
Figure 15: Stolen address books |
Figure 16: Victims by country |
Figure 17: Contacts by country |
The first phone UUID in the list ffffffff-e76f-903a-ffff-ffffef05ac4a reports to be in India, and has installed an apk SetupIndiaServicesTnC.apk.The first phone on an operational server often is a test/developer account, and in this case, contained data that was part of a test rig. A consecutive UUID ffffffff-e76f-903a-ffff-ffffef05ac4b also appears in the device list. The uuid is constructed using >nisrulz's easydeviceinfo.
Figure 18: construction of UUID
Lastly, the threat actor also leverages windows malware, leveraging the same C2 infrastructure. These samples are available in the index.
|
Top level file |
intermediary |
c2 |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
Vendor |
Name |
|---|---|
|
Proofpoint |
UNK_ArmyDrive |
|
You? |
Get in touch for blog pre-releases! |
Figure 19: Vendor validated names
Our github provides a download of the relevant mentioned in the blog, except those that contain victim identifying information
|
Hunting leads you may find useful |
|---|
|
C:\Users\Android\Desktop\full working with all and url encrypt\x64\Release\ConsoleApplication1.pdb |
|
C:\Users\Android\Desktop\lsass - Copy\x64\Release\ConsoleApplication1.pdb |
|
C:\Users\Android\Desktop\work\d\x64\Release\ConsoleApplication1.pdb |
|
C:\Users\user\Desktop\c\d\x64\Release\ConsoleApplication1.pdb |
|
C:\Users\user\Desktop\cache\apk\c\i\x64\Debug\ConsoleApplication1.pdb |
|
C:\Users\user\Desktop\ppp\app\c\d\x64\Debug\ConsoleApplication1.pdb |
|
Network strings containing "ghijkl" |
|
emails addresses containing |
|
|
Acknowledgements
The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.com if you have corrections, would like us to use your group name, or would like to collaborate on research.