Introduction
(Talos) Cisco Talos recently discovered a malicious campaign targeting government employees and military personnel in the Indian sub-continent with two commercial and commodity RAT families known as NetwireRAT (aka NetwireRC) and WarzoneRAT (aka Ave Maria). The attackers delivered a variety of lures to their targets, predominantly posing as guides related to Indian governmental infrastructure and operations such as Kavach and I.T.-related guides in the form of malicious Microsoft Office documents (maldocs) and archives (RARs, ZIPs) containing loaders for the RATs. Some of these lures and tactics utilized by the attackers bear a strong resemblance to the ‘Transparent Tribe, APT 36’ and ‘SideCopy’ APT groups, including the use of compromised websites and fake domains.
Activities and Tactics
Country of Origin: 🇵🇰 [“Pakistan”]
First Seen: 2021
Last Activity: 2021
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.
Malware and Tools
- NetWire RC
- Warzone RAT
- NetWire RC:
- Warzone RAT:
Attribution and Evidence
Country of Origin: [“Pakistan”] Additional attribution information pending cataloguing.
References
References pending cataloguing.