A suspected South Asian cyberespionage group active since at least 2013 has recently targeted organizations in the region using three distinct infection chains. The campaign leverages PowerShell scripts and a custom remote access trojan to establish persistent access to victim environments. Initial access is achieved through malicious LNK files, VHDX disk images, and URL shortcuts that retrieve additional components. The group targets government, energy, and engineering sectors, with telemetry indicating a concentration of victims in South Asia. The risk is high, as compromised machines fall under full attacker control, allowing for long-term surveillance and data exfiltration without immediate detection by standard endpoint controls.
The first chain abuses the native Windows ftp.exe utility to execute scripts hidden in icon files, creating scheduled tasks that maintain contact with remote servers. This approach bypasses common script-engine monitoring by avoiding direct PowerShell or wscript usage. The second and third chains deploy the remote access trojan via MSI installers, which masquerade as legitimate Microsoft components. The implant establishes a persistent connection to a hardcoded command-and-control server over plaintext HTTP, checking in every ten seconds for new instructions. It supports commands for remote shell execution, file uploads and downloads, directory enumeration, and screenshot capture. A newer Rust variant expands these capabilities by adding PowerShell execution, a sleep directive, and a clean exit command, while storing sensitive constants in reversed and shifted formats to evade static analysis.[/subscribe_to_unlock_form]
A suspected South Asian cyberespionage group active since at least 2013 has recently targeted organizations in the region using three distinct infection chains. The campaign leverages PowerShell scripts and a custom remote access trojan to establish persistent access to victim environments. Initial access is achieved through malicious LNK files, VHDX disk images, and URL shortcuts that retrieve additional components. The group targets government, energy, and engineering sectors, with telemetry indicating a concentration of victims in South Asia. The risk is high, as compromised machines fall under full attacker control, allowing for long-term surveillance and data exfiltration without immediate detection by standard endpoint controls.
The first chain abuses the native Windows ftp.exe utility to execute scripts hidden in icon files, creating scheduled tasks that maintain contact with remote servers. This approach bypasses common script-engine monitoring by avoiding direct PowerShell or wscript usage. The second and third chains deploy the remote access trojan via MSI installers, which masquerade as legitimate Microsoft components. The implant establishes a persistent connection to a hardcoded command-and-control server over plaintext HTTP, checking in every ten seconds for new instructions. It supports commands for remote shell execution, file uploads and downloads, directory enumeration, and screenshot capture. A newer Rust variant expands these capabilities by adding PowerShell execution, a sleep directive, and a clean exit command, while storing sensitive constants in reversed and shifted formats to evade static analysis.[emaillocker id="1283"]
The activity demonstrates continued investment in the toolset, with the transition from C++ to Rust indicating active development and expansion of the implant's command set. The campaign's scale remains focused on South Asian organizations, with no indication of broader global targeting at the time of analysis. Defensive implications suggest that organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages. Combining user awareness with controls that detect suspicious execution chains and outbound traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1204.002 | User Execution | Malicious File |
| Execution | T1059.003 | Command and Scripting Interpreter | Windows Command Shell |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Defense Evasion | T1027.001 | Obfuscated Files or Information | Stored Data Obfuscation |
| Discovery | T1082 | System Information Discovery | - |
| Collection | T1056.001 | Input Capture | Keylogging |
| Collection | T1005 | Data from Local System | - |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1105 | Ingress Tool Transfer | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Command and Control | B0030 | C2 Communication |
| Command and Control | E1105 | Ingress Tool Transfer |
| Collection | E1113 | Screen Capture |
| Discovery | E1083 | File and Directory Discovery |
| Discovery | E1082 | System Information Discovery |
| Exfiltration | E1020 | Automated Exfiltration |
| Execution | E1204 | User Execution |
| Execution | E1059 | Command and Scripting Interpreter |
| Execution | B0011 | Remote Commands |
| Execution | B0023 | Install Additional Program |
| Persistence | B0022 | Remote Access |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
The following reports contain further technical details:
[/emaillocker]