Confucius

Also known as: Confucius, Confucius APT, G0142

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets. TrendMicro Confucius APT Feb 2018 TrendMicro Confucius APT Aug 2021 Uptycs Confucius APT Jan 2021

🌍 Country ["India"]
🧭 ATT&CK G0142

Associated Operations

2017 Late 2017-10 2018-05 2021-08 Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military During their previous campaign In recent weeks Pashto Persian Probing Confucius’ infrastructure Simple Chat Point: Secret Chat Point Unit 42 has discovered three documents crafted to exploit the InPage program. InPage is a word processor program that supports languages such as Urdu and Arabic. The three InPage exploit files are linked through their use of very similar shellcode and Tweety Chat. We are admittedly uncertain of the extent — and success — of their use but it’s one of the ingredients of the group’s operations. https://blog.trendmicro.com/trendlabs-security-intelligence/confucius-update-new-tools-and-techniques-further-connections-with-patchwork/ https://blog.trendmicro.com/trendlabs-security-intelligence/deciphering-confucius-cyberespionage-operations/ https://unit42.paloaltonetworks.com/unit42-recent-inpage-exploits-lead-multiple-malware-families/ https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html most likely iterations of its predecessor or the attackers have access to a shared builder. setting up two new websites and new payloads with which to compromise its targets. the threat actor seems to have a new modus operandi we came across websites offering Windows and Android chat applications we found Confucius using fake romance websites to entice victims into installing malicious Android applications. This time which suggests that either the same actor is behind these attacks

Introduction

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets. TrendMicro Confucius APT Feb 2018 TrendMicro Confucius APT Aug 2021 Uptycs Confucius APT Jan 2021

Activities and Tactics

Country of Origin: 🇮🇳 [“India”]

Notable Campaigns

  • 2017 Late
  • 2017-10
  • 2018-05
  • 2021-08
  • Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military
  • During their previous campaign
  • In recent weeks
  • Pashto
  • Persian
  • Probing Confucius’ infrastructure
  • Simple Chat Point: Secret Chat Point
  • Unit 42 has discovered three documents crafted to exploit the InPage program. InPage is a word processor program that supports languages such as Urdu
  • and Arabic. The three InPage exploit files are linked through their use of very similar shellcode
  • and Tweety Chat. We are admittedly uncertain of the extent — and success — of their use
  • but it’s one of the ingredients of the group’s operations.
  • https://blog.trendmicro.com/trendlabs-security-intelligence/confucius-update-new-tools-and-techniques-further-connections-with-patchwork/
  • https://blog.trendmicro.com/trendlabs-security-intelligence/deciphering-confucius-cyberespionage-operations/
  • https://unit42.paloaltonetworks.com/unit42-recent-inpage-exploits-lead-multiple-malware-families/
  • https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html
  • most likely iterations of its predecessor
  • or the attackers have access to a shared builder.
  • setting up two new websites and new payloads with which to compromise its targets.
  • the threat actor seems to have a new modus operandi
  • we came across websites offering Windows and Android chat applications
  • we found Confucius using fake romance websites to entice victims into installing malicious Android applications. This time
  • which suggests that either the same actor is behind these attacks

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CyberGate:
  • Cyber Eye RAT:
  • Archelaus Beta:
  • ApacheStealer:
  • Confucius:
  • Hornbill:
  • MY24:
  • Sneepy:
  • SunBird:
  • remote-access-c3:
  • sctrls:
  • sip_telephone:
  • swissknife2:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: [“India”] Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] TrendMicro Confucius APT Feb 2018 Lunghi, D and Horejsi, J. (2018, February 13). Deciphering Confucius: A Look at the Group’s Cyberespionage Operations. Retrieved December 26, 2021. [3] TrendMicro Confucius APT Aug 2021 Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021. [4] Uptycs Confucius APT Jan 2021 Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.