SideWinder APT Using New WarHawk Backdoor to Target Entities in Pakistan

SideWinder, a prolific country-point out actor mainly identified for concentrating on Pakistan navy entities, compromised the formal web site of the Nationwide Electric Electric power Regulatory Authority (NEPRA) to deliver a tailored malware identified as WarHawk.

“The freshly discovered WarHawk backdoor is made up of numerous malicious modules that provide Cobalt Strike, incorporating new TTPs such as KernelCallBackTable injection and Pakistan Regular Time zone examine in buy to make sure a victorious marketing campaign,” Zscaler ThreatLabz explained.

The menace team, also named APT-C-17, Rattlesnake, and Razor Tiger, is suspected to be an Indian condition-sponsored team, despite the fact that a report from Kaspersky previously this May possibly acknowledged preceding indicators that led to the attribution have considering the fact that disappeared, creating it hard it to link the risk cluster to a specific country.

Much more than 1,000 assaults are reported to have been released by the group considering the fact that April 2020, an indication of SideWinder’s newfound aggression considering the fact that it commenced operations a ten years back in 2012.

The intrusions have been sizeable not only with regard to their frequency but also in their persistence, even as the group normally takes advantage of a significant arsenal of obfuscated and freshly-created elements.

In June 2022, the risk actor was observed leveraging an AntiBot script that is created to filter their victims to look at the customer browser atmosphere, precisely the IP tackle, to be certain the targets are found in Pakistan.

The September campaign spotted by Zscaler entails the use of a weaponized ISO file hosted on NEPRA’s internet site to activate a killchain that potential customers to the deployment of the WarHawk malware, with the artifact also performing as a decoy to cover the malicious action by displaying a legitimate advisory issued by the Cupboard Division of Pakistan on July 27, 2022.

WarHawk, for its portion, masquerades as legitimate apps this kind of as ASUS Update Setup and Realtek High definition Audio Manager to entice unsuspecting victims into execution, resulting the exfiltration of program metadata to a really hard-coded remote server, though also receiving supplemental payloads from the URL.

This includes a command execution module that is dependable for the execution of process commands on the contaminated machine received from the command-and-control server, a file manager module that recursively enumerates files current in different drives, and an upload module that transmits documents of fascination to the server.

Also deployed as a second-phase payload applying the aforementioned command execution module is a Cobalt Strike Loader, which validates the host’s time zone to validate it matches the Pakistan Typical Time (PKT), failing which the method is terminated.

Pursuing the anti-anThe loader injects shellcode into a notepad.exe course of action employing a approach referred to as KernelCallbackTable method injection, with the malware creator lifting resource code from a technological compose-up printed in April 2022 by a researcher who goes by the on the net alias Capt. Meelo.

The shellcode then decrypts and masses Beacon, the default malware payload utilised by Cobalt Strike to build a relationship to its command-and-management server.

Per the cybersecurity company, the attack campaign’s connections to the SideWinder APT stem from the reuse of network infrastructure that has been identified as applied by the team in prior espionage-focused functions in opposition to Pakistan.

“The SideWinder APT Team is continually evolving their practices and incorporating new malware to their arsenal in buy to carry out productive espionage attack strategies against their targets,” the scientists concluded.

Located this posting fascinating? Adhere to THN on Facebook, Twitter  and LinkedIn to examine additional distinctive content we write-up.

Some parts of this article are sourced from:
thehackernews.com