Indian authorities entities and vitality firms have been focused by unknown menace actors with an goal to ship a modified model of an open-source data stealer malware referred to as HackBrowserData and exfiltrate delicate data in some circumstances by utilizing Slack as command-and-control (C2).
“The knowledge stealer was delivered by way of a phishing electronic mail, masquerading as an invite letter from the Indian Air Pressure,” EclecticIQ researcher Arda Büyükkaya stated in a report revealed as we speak.
“The attacker utilized Slack channels as exfiltration factors to add confidential inside paperwork, personal electronic mail messages, and cached net browser knowledge after the malware’s execution.”
The marketing campaign, noticed by the Dutch cybersecurity agency starting March 7, 2024, has been codenamed Operation FlightNight in reference to the Slack channels operated by the adversary.
Targets of the malicious exercise span a number of authorities entities in India, counting these associated to digital communications, IT governance, and nationwide protection.
The menace actor is alleged to have efficiently compromised personal vitality firms, harvesting monetary paperwork, private particulars of staff, particulars about drilling actions in oil and fuel. In all, about 8.81 GB of information has been exfiltrated over the course of the marketing campaign.
The assault chain begins with a phishing message containing an ISO file (“invite.iso”), which, in flip, incorporates a Home windows shortcut (LNK) that triggers the execution of a hidden binary (“scholar.exe”) current throughout the mounted optical disk picture.
Concurrently, a lure PDF file that purports to be an invite letter from the Indian Air Pressure is exhibited to the sufferer whereas the malware clandestinely harvests paperwork and cached net browser knowledge and transmits them to an actor-controlled Slack channel named FlightNight.
The malware is an altered model of HackBrowserData that goes past its browser knowledge theft options to include capabilities to siphon paperwork (Microsoft Workplace, PDFs, and SQL database information), talk over Slack, and higher evade detection utilizing obfuscation methods.
It is suspected that the menace actor stole the decoy PDF throughout a earlier intrusion, with behavioral similarities traced again to a phishing marketing campaign concentrating on the Indian Air Pressure with a Go-based stealer referred to as GoStealer.
Particulars of the exercise have been disclosed by an Indian safety researcher who goes by the alias xelemental (@ElementalX2) in mid-January 2024.
The GoStealer an infection sequence is nearly an identical to that FlightNight, using procurement-themed lures (“SU-30 Plane Procurement.iso”) to show a decoy file whereas the stealer payload is deployed to exfiltrate data of curiosity over Slack.
By adapting freely out there offensive instruments and repurposing reputable infrastructure reminiscent of Slack that is prevalent in enterprise environments, it permits menace actors to scale back time and improvement prices, in addition to simply fly underneath the radar.
 |
| Picture supply: ElementalX2 |
The effectivity advantages additionally imply that it is that a lot simpler to launch a focused assault, even permitting less-skilled and aspiring cybercriminals to spring into motion and inflict important injury to organizations.
“Operation FlightNight and the GoStealer marketing campaign spotlight a easy but efficient method by menace actors to make use of open-source instruments for cyber espionage,” Büyükkaya stated.
“This underscores the evolving panorama of cyber threats, whereby actors abuse extensively used open-source offensive instruments and platforms to attain their targets with minimal threat of detection and funding.”
