Introduction
VICEROY TIGER is an adversary with a nexus to India that has historically targeted entities throughout multiple sectors. Older activity targeted multiple sectors and countries; however, since 2015 this adversary appears to focus on entities in Pakistan with a particular focus on government and security organizations. This adversary consistently leverages spear phishing emails containing malicious Microsoft Office documents, malware designed to target the Android mobile platform, and phishing activity designed to harvest user credentials. In March 2017, the 360 Chasing Team found a sample of targeted attacks that confirmed the previously unknown sample of APTโs attack actions, which the organization can now trace back at least in April 2016. The chasing team named the attack organization APT-C-35. In June 2017, the 360 Threat Intelligence Center discovered the organizationโs new attack activity, confirmed and exposed the gangโs targeted attacks against Pakistan, and analyzed in detail. The unique EHDevel malicious code framework used by the organization.
Activities and Tactics
Targeted Sectors: Government, Administration, Security Service
Country of Origin: ๐ฎ๐ณ India
Risk Level: High
Suspected Victims: Germany
Notable Campaigns
- 2019-03
- 2019-04
- 2019-12
- 2020
- 2020-05
- 2022-08
- 2023-06
- 2024-10
- APT-C-35 Gets a New Upgrade
- An Indicator From Twitter Brings The Donot Android Espionage Group Back Into Focus
- Android Malware in DONOT APT Operations
- DoNot APT Elevates its Tactics by Deploying Malicious Android Apps on Google Play Store
- ESET researchers take a deep look into recent attacks carried out by Donot Team throughout 2020 and 2021
- From March to July this year
- Lucky Elephant
- Recently
- StealJob: New Android Malware
- Togo: Prominent activist targeted with Indian-made spyware linked to notorious hacker group
- https://blog.morphisec.com/apt-c-35-new-windows-framework-revealed
- https://threatrecon.nshc.net/2019/08/02/sectore02-updates-yty-framework-in-new-targeted-campaign-against-pakistan-government/
- https://ti.360.net/blog/articles/stealjob-new-android-malware-used-by-donot-apt-group-en/
- https://www.amnesty.org/en/latest/news/2021/10/togo-activist-targeted-with-spyware-by-notorious-hacker-group/
- https://www.cyfirma.com/outofband/donot-apt-elevates-its-tactics-by-deploying-malicious-android-apps-on-google-play-store/
- https://www.cyfirma.com/research/android-malware-in-donot-apt-operations/
- https://www.riskiq.com/blog/external-threat-management/donot-mobile-malware-espionage/
- https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
- targeting government and military entities in several South Asian countries
- the ThreatRecon team noticed a spear phishing campaign by the SectorE02 group going on against the Government of Pakistan and organizations there related to defense and intelligence.
- we have observed a large-scale upgrade of its malicious Android APK framework to make it more stable and practical. Since the new APK framework is quite different from the one used in the past
- we named it as StealJob since โjobโ is frequently used in the code.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- MobileOrder
- Unknown Logger
- Back Orifice
- Back Orifice 2000
- DroidJack
- Androrat
- EHDevel:
- yty:
- BackConfig:
Attribution and Evidence
Country of Origin: India Additional attribution information pending cataloguing.
References
References pending cataloguing.