Dangerous new cybercrime gang attacks government and military targets

Hacker
Image Credit: Geralt / Pixabay (Image credit: Image Credit: Geralt / Pixabay)

A dangerous new cybercrime group has been spotted targeting government agencies and military organizations in the Asia-Pacific region. 

According to multiple cybersecurity firms who spotted the threat actor, it seems to be deploying unorthodox tactics to obtain sensitive information from target endpoints.

Two cybersecurity firms were initially tracking the attackers - Group-IB, and Anheng Hunting Labs. While the former dubbed the group Dark Pink, the latter calls it Saaiwc Group. Regardless of the name, the hackers are using spear-phishing attacks for initial deployment, and infected USB drives for spreading.

Abusing known flaws

The spear-phishing emails are usually fake job applications designed to lure victims into downloading weaponized ISO files. These files would abuse a known high-severity vulnerability tracked as CVE-2017-0199 (Office/WordPad remote code execution vulnerability) to deploy either Ctealer or Cucky (custom-built infostealers). These would later deploy a registry implant named TelePowerBot. 

A separate method was observed deploying KamiKakaBot, designed to read and execute commands.

Both Cucky and Ctealer are designed to steal passwords, browsing history, saved credentials, and cookies from most of today's popular browsers (and then some). Furthemore, the group is able to access messenger applications, steal documents, and grab audio via microphones connected to infected devices.

“During infection, the threat actors execute several standard commands (e.g. net share, Get-SmbShare) to determine what network resources are connected to the infected device. If network disk usage is found, they will begin exploring this disk to find files that may be of interest to them and potentially exfiltrate them,” Group-IB explained.

In the second half of 2022, the group launched at least seven successful attacks, the researchers claim.

All seven organizations (for which the attacks had been confirmed) have been notified of the attack and were given tips on how to proceed. The researchers state that it’s highly likely that the group compromised an even bigger number of organizations, but confirmations are yet to come. 

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
An American flag flying outside the US Capitol building against a blue sky
US military and defense contractors hit with Infostealer malware
Russia
Major Russian hacking group shifts focus to US and UK targets
China
Chinese hackers develop effective new hacking technique to go after business networks
China
Microsoft says Chinese Silk Typhoon hackers are targeting cloud and IT apps to steal business data
A person at a laptop with a cybersecure lock symbol floating above it.
Cybercrime gang targets victims with "triple threat" attacks
Red padlock open on electric circuits network dark red background
Aviation firms hit by devious new polyglot malware
Latest in Security
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
Latest in News
DeepSeek
Deepseek’s new AI is smarter, faster, cheaper, and a real rival to OpenAI's models
Open AI
OpenAI unveiled image generation for 4o – here's everything you need to know about the ChatGPT upgrade
Apple WWDC 2025 announced
Apple just announced WWDC 2025 starts on June 9, and we'll all be watching the opening event
Hornet swings their weapon in mid air
Hollow Knight: Silksong gets new Steam metadata changes, convincing everyone and their mother that the game is finally releasing this year
OpenAI logo
OpenAI just launched a free ChatGPT bible that will help you master the AI chatbot and Sora
An aerial view of an Instavolt Superhub for charging electric vehicles
Forget gas stations – EV charging Superhubs are using solar power to solve the most annoying thing about electric motoring