Malwaremedium
Pakistani Hackers Use DISGOMOJI Malware in Indian Government Cyber Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel | 7.8 | 93% | KEVPoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | oshi.at | file to the victim's device 👉 - Download a file hosted on oshi[.]at to the victim's device 🔥 - Find and exfiltrate files mat |
| domain | transfer.sh | the channel 👈 - Upload a file from the victim's device to transfer[.]sh ☝️ - Download a file to the victim's device 👉 - Download |
From the original article
2 min read at thehackernews.com
A suspected Pakistan-based threat actor has been linked to a cyber espionage campaign targeting Indian government entities in 2024. Cybersecurity company Volexity is tracking the activity under the moniker UTA0137, noting the adversary's exclusive use of a malware called DISGOMOJI that's written in Golang and is designed to infect Linux systems.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.