{"id":167,"date":"2022-07-20T23:05:46","date_gmt":"2022-07-20T23:05:46","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=167"},"modified":"2022-07-20T23:05:46","modified_gmt":"2022-07-20T23:05:46","slug":"campaign-attributed-to-apt-c-36-context-and-iocs","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2022\/07\/20\/campaign-attributed-to-apt-c-36-context-and-iocs\/","title":{"rendered":"Campaign attributed to APT-C-36 context and IoCs"},"content":{"rendered":"

Overview<\/h1>\n

The following report provides the TTPs,and IOCs identified in a malware campaign impersonating the \u201cFiscal\u00eda General de la Naci\u00f3n\u201d from Colombia. Our research team identified this campaign through threat hunting on public sources.<\/p>\n

The group behind this campaign is APT-C-36,<\/strong> also know as Blind Eagle.<\/strong> Most TTPs coincide with previous campaigns attributed to this cybercriminal group in public investigations.<\/p>\n

SCILabs was unable to identify the initial attack vector; however, we determined with high confidence that as in the previous campaigns, the attackers are distributing the malware through phishing emails with a PDF document attached. We make this hypothesis based on the TTPs that we observed in previous campaigns<\/a> of this threat group.<\/p>\n

Like the previous campaign, the cybercriminals continue using njRAT<\/a>. As it is known, this kind of trojans has similar capabilities like stealing credentials stored in browsers, opening a reverse shell, uploading and downloading files, as well as a password stealer and a keylogger among others.<\/p>\n

Based on the TTPs identified and the capabilities identified in the malware used by the attackers, the objective of this campaign is the theft of user information in Colombia.<\/p>\n

How could it affect an organization?<\/h1>\n

The attackers mainly target users in Colombia; the attacker’s goal is implant a backdoor to control the target computer and provide the basis for lateral moves and other types of attacks related to the theft of sensitive information, which can cause financial and reputational losses in the affected companies.<\/p>\n

Analysis<\/h1>\n

Threat Context<\/h1>\n

SCILabs recovered a PDF file through threat hunting in public sources; the file includes a hyperlink to the One Drive servers, which leads to the download of a password-protected BZ2-type compressed file with a .vbs file inside. The password is inside the PDF file.<\/p>\n

\"\"<\/p>\n

The .vbs file downloads a text file that contains a PowerShell encoded script to perform the following operations:<\/p>\n