SideWinder Hackers Use Fake Android VPN Apps to Target Pakistani Entities

The menace actor identified as SideWinder has included a new personalized software to its arsenal of malware that is being utilized in phishing assaults towards Pakistani community and private sector entities.

“Phishing inbound links in e-mails or posts that mimic authentic notifications and services of federal government agencies and companies in Pakistan are major attack vectors of the gang,” Singapore-headquartered cybersecurity business Team-IB said in a Wednesday report.

SideWinder, also tracked under the monikers Hardcore Nationalist, Rattlesnake, Razor Tiger, and T-APT-04, has been active considering that at minimum 2012 with a major aim on Pakistan and other Central Asian countries like Afghanistan, Bangladesh, Nepal, Singapore, and Sri Lanka.

Last thirty day period, Kaspersky attributed to this group in excess of 1,000 cyber assaults that took location in the earlier two a long time, although contacting out its persistence and refined obfuscation approaches.

The threat actor’s modus operandi consists of the use of spear-phishing emails to distribute destructive ZIP archives made up of RTF or LNK information, which download an HTML Software (HTA) payload from a remote server.

This is reached by embedding fraudulent back links that are built to mimic respectable notifications and providers of government agencies and corporations in Pakistan, with the team also placing up lookalike internet websites posing as govt sites to harvest consumer qualifications.

The custom made device discovered by Team-IB, dubbed SideWinder.AntiBot.Script, acts as a site visitors path system diverting Pakistani consumers clicking on the phishing hyperlinks to rogue domains.

Need to a user whose client’s IP tackle differs from Pakistan’s tap on the link, the AntiBot script redirects to an reliable document positioned on a legit server, indicating an endeavor to geofence its targets.

“The script checks the customer browser ecosystem and, dependent on quite a few parameters, decides no matter whether to issue a malicious file or redirect to a respectable resource,” the researchers reported.

Of unique mention is a phishing backlink that downloads a VPN application called Protected VPN (“com.securedata.vpn”) from the official Google Participate in retail outlet in an endeavor to impersonate the respectable Safe VPN app (“com.securevpn.securevpn”).

Whilst the actual reason of the phony VPN application stays unclear, this is not the 1st time SideWinder has sneaked earlier Google Perform Keep protections to publish rogue applications below the pretext of utility computer software.

In January 2020, Trend Micro thorough 3 destructive applications that have been disguised as images and file manager equipment that leveraged a security flaw in Android (CVE-2019-2215) to gain root privileges as properly as abuse accessibility provider permissions to harvest sensitive information and facts.

Identified this article interesting? Follow THN on Fb, Twitter  and LinkedIn to study a lot more exclusive written content we post.

Some parts of this article are sourced from:
thehackernews.com