Vulnerabilitymedium
ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apnits.4t.com | . The web design and technology services company hosted at “apnits[.]4t[.]com” listed the phone number "0345-2183117" for its chief e |
| domain | bbmdroid.blogspot.com | d little content of interest with the following exceptions: bbmdroid[.]blogspot[.]com indian-attack[.]blogspot[.]com Freeowlsofminerva[.]blog |
| domain | bbmdroid.com | romeda and Peppy samples as those previously observed using bbmdroid[.]com as a C2, which were hosted at “/est/estma.exe” and “/est/ |
| domain | easternkingsology.com | ign company started by the actor. We found a third domain, “easternkingsology[.]com,” that contained registration information with the name “ |
| domain | freeowlsofminerva.blogspot.com | s: bbmdroid[.]blogspot[.]com indian-attack[.]blogspot[.]com Freeowlsofminerva[.]blogspot[.]com Figure 11 Picture of Individual Associated with Blogger |
| domain | indian-attack.blogspot.com | st with the following exceptions: bbmdroid[.]blogspot[.]com indian-attack[.]blogspot[.]com Freeowlsofminerva[.]blogspot[.]com Figure 11 Picture of |
| domain | intribune.blogspot.com | me related to India closely resembles the India News Tribe (intribune[.]blogspot[.]com) blog that ProjectM used in Operation Transparent Tribe |
| domain | messagerieneuf.com | py, DarkComet, Andromeda) mustache-styles[.]com (Andromeda) messagerieneuf[.]com (Crimson) sahirlodhi[.]com (Crimson) Figure 6 Possible Ac |
| domain | microsoftexcel.united-host.us | he links on the blog point to Excel spreadsheets hosted on “microsoftexcel[.]united-host[.]us”, such as: hxxp://microsoftexcel[.]united-host[.]us/Dow |
| domain | mustache-styles.com | Peppy, Bozok) shobitech[.]com (Peppy, DarkComet, Andromeda) mustache-styles[.]com (Andromeda) messagerieneuf[.]com (Crimson) sahirlodhi[.]c |
| domain | ordering-checks.com | . The two undisguised domains were “winupdater[.]info” and “ordering-checks[.]com”, which were registered using the email address “mshoaib. |
| domain | sahirlodhi.com | R[.]SOFT. The advertisement seen in Figure 4 was hosted on “sahirlodhi[.]com”, which was a domain also used by ProjectM as the downloa |
| domain | shoaibyaseen.com | another Facebook account belonging to this actor points to “shoaibyaseen[.]com”, which appears to host this individual’s personal blog. |
| domain | shobitech.com | iated with ProjectM, such as: bbmdroid[.]com (Peppy, Bozok) shobitech[.]com (Peppy, DarkComet, Andromeda) mustache-styles[.]com (Andr |
| domain | spid3r.soft | m on an advertisement for another web design company called SPID3R[.]SOFT. The advertisement seen in Figure 4 was hosted on “sahirl |
| domain | thefriendsfm.com | vely. The “thefriendsmedia[.]com” site makes references to “thefriendsfm[.]com”, which was originally registered in October 2010 using t |
| domain | thefriendsmedia.com | SOFT Web Design In addition to xtexhosts[.]com, the domain “thefriendsmedia[.]com” was also registered using the email “spid3rsoft[at]gmail |
| domain | winupdater.info | for the Andromeda Trojan. The two undisguised domains were “winupdater[.]info” and “ordering-checks[.]com”, which were registered using |
| domain | xtexhosts.com | e found the registration phone number and email address for xtexhosts[.]com on an advertisement for another web design company called |
| sha256 | cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157 | r not; however, we did observe a DarkComet payload (SHA256: cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157) hosted on this server at “microsoftexcel[.]united-host[.]u |
| sha256 | dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c | e in the debug symbol path of a Crimson downloader (SHA256: dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c): E:\Projects\m_project\main\mj shoaib\Thin Client\secure_s |
| sha256 | e4dfcf3db512260e1a4ff414907610d5d5279143fa9ade9219d8691be02e512f | le at hxxp://easternkingsology[.]com/det/dllbb.exe (SHA256: e4dfcf3db512260e1a4ff414907610d5d5279143fa9ade9219d8691be02e512f), which suggests the threat actor hosted this Trojan on an |
| url | http://easternkingsology.com/det/dllbb.exe | asternkingsology[.]com” domain hosted a Bozok RAT sample at hxxp://easternkingsology[.]com/det/dllbb.exe (SHA256: e4dfcf3db512260e1a4ff414907610d5d5279143fa9ade92 |
| url | http://microsoftexcel.united-host.us/Downloads/(Bera | ets hosted on “microsoftexcel[.]united-host[.]us”, such as: hxxp://microsoftexcel[.]united-host[.]us/Downloads/(Bera)%20FM%20Price%20List.xls The blog also includes a link |
From the original article
11 min read at unit42.paloaltonetworks.comBe the first to receive the latest news, cyber threat intelligence and research from Unit 42. Subscribe Now . Unit 42 is currently researching an attack campaign that targets government and military personnel of India.
By Simon Conant · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.