Operation RusticWeb

Also known as: Operation RusticWeb

(Seqrite) SEQRITE Labs APT-Team has uncovered a phishing campaign targeting various Indian government personnel since October 2023. We have also identified targeting of both government and private entities in the defence sector over December. New Rust-based payloads and encrypted PowerShell commands have been utilized to exfiltrate confidential documents to a web-based service engine, instead of a dedicated command-and-control (C2) server. With actively modifying its arsenal, it has also used fake domains to host malicious payloads and decoy files. This campaign is tracked as Operation RusticWeb, where multiple TTPs overlap with Pakistan-linked APT groups – ‘Transparent Tribe, APT 36’ and ‘SideCopy’. It also has similarities with ‘Operation Armor Piercer’ report released by Cisco in 2021, and the targeting with the ESSA scholarship form of AWES was observed by our team back in the same year.

🌍 Country ["Pakistan"]

Introduction

(Seqrite) SEQRITE Labs APT-Team has uncovered a phishing campaign targeting various Indian government personnel since October 2023. We have also identified targeting of both government and private entities in the defence sector over December. New Rust-based payloads and encrypted PowerShell commands have been utilized to exfiltrate confidential documents to a web-based service engine, instead of a dedicated command-and-control (C2) server. With actively modifying its arsenal, it has also used fake domains to host malicious payloads and decoy files. This campaign is tracked as Operation RusticWeb, where multiple TTPs overlap with Pakistan-linked APT groups – ‘Transparent Tribe, APT 36’ and ‘SideCopy’. It also has similarities with ‘Operation Armor Piercer’ report released by Cisco in 2021, and the targeting with the ESSA scholarship form of AWES was observed by our team back in the same year.

Activities and Tactics

Country of Origin: 🇵🇰 [“Pakistan”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

Information pending cataloguing.

Attribution and Evidence

Country of Origin: [“Pakistan”] Additional attribution information pending cataloguing.

References

References pending cataloguing.