An exposed open directory revealed a collection of scripts and executables linked to APT DoNot, also tracked as APT-C-35, in a cyber espionage operation aimed at Pakistan’s nuclear, energy, and industrial-control sectors. The material references SCADA and Modbus-related terms and appears to have been staged on a remote server for use against an internal Windows environment. The initial access vector is not established in the available material, but the recovered collection indicates a focus on strategic-sector targets and the risk of credential theft, internal reconnaissance, and lateral movement.
Once a foothold was present, the toolkit performed environment checks, confirmed command-and-control reachability, and staged additional components in a local directory. Multiple reverse-shell paths ran in parallel, using PowerShell scripts and compiled Go binaries to maintain outbound connections, while a separate implant polled over HTTP and retrieved commands from response headers. Later builds added symbol stripping and encrypted transport. Credential capture relied on poisoning local name-resolution services to collect NetNTLM hashes, with configurations run in hidden child processes and with domain or workgroup variables altered to appear legitimate. Reconnaissance scripts mapped the network, enumerated a user profile, searched for nuclear and industrial-control keywords, and tested collected or hardcoded credentials against administrative shares on nearby hosts.[/subscribe_to_unlock_form]
An exposed open directory revealed a collection of scripts and executables linked to APT DoNot, also tracked as APT-C-35, in a cyber espionage operation aimed at Pakistan’s nuclear, energy, and industrial-control sectors. The material references SCADA and Modbus-related terms and appears to have been staged on a remote server for use against an internal Windows environment. The initial access vector is not established in the available material, but the recovered collection indicates a focus on strategic-sector targets and the risk of credential theft, internal reconnaissance, and lateral movement.
Once a foothold was present, the toolkit performed environment checks, confirmed command-and-control reachability, and staged additional components in a local directory. Multiple reverse-shell paths ran in parallel, using PowerShell scripts and compiled Go binaries to maintain outbound connections, while a separate implant polled over HTTP and retrieved commands from response headers. Later builds added symbol stripping and encrypted transport. Credential capture relied on poisoning local name-resolution services to collect NetNTLM hashes, with configurations run in hidden child processes and with domain or workgroup variables altered to appear legitimate. Reconnaissance scripts mapped the network, enumerated a user profile, searched for nuclear and industrial-control keywords, and tested collected or hardcoded credentials against administrative shares on nearby hosts.[emaillocker id="1283"]
The exposed material indicates an active, iterative operation rather than a static collection, with configurations and binaries changing over several days. The targeting language points to Pakistan’s nuclear, energy, and industrial-control environment, while the infrastructure and tradecraft links support a possible connection to APT DoNot, a group associated with South Asian government and defense interests. No confirmed victim count is established, but the strategic-sector focus raises the risk of espionage against critical infrastructure. Defenders should treat exposed staging infrastructure as a useful source of operational intent and prioritize detection of local name-resolution poisoning, hidden credential-harvesting processes, and repeated reverse-shell activity.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Defense Evasion | T1036 | Masquerading | - |
| Defense Evasion | T1055 | Process Injection | - |
| Credential Access | T1557.001 | Adversary-in-the-Middle | LLMNR/NBT-NS Poisoning |
| Credential Access | T1552.001 | Credentials in Files | Credentials in Files |
| Discovery | T1083 | File and Directory Discovery | - |
| Discovery | T1082 | System Information Discovery | - |
| Discovery | T1012 | Query Registry | - |
| Lateral Movement | T1021.002 | Remote Services | SMB/Windows Admin Shares |
| Collection | T1074.001 | Data Staged | Local Data Staging |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1105 | Ingress Tool Transfer | - |
The following reports contain further technical details:
[/emaillocker]