NewsPenguin Threat Actor Emerges with Malicious Campaign Targeting Pakistani Entities

A earlier unknown threat actor dubbed NewsPenguin has been connected to a phishing marketing campaign targeting Pakistani entities by leveraging the future worldwide maritime expo as a entice.

“The attacker despatched out specific phishing e-mail with a weaponized document attached that purports to be an exhibitor manual for PIMEC-23,” the BlackBerry Study and Intelligence Team said.

PIMEC, shorter for Pakistan Global Maritime Expo and Convention, is an initiative of the Pakistan Navy and is organized by the Ministry of Maritime Affairs with an aim to “soar start out advancement in the maritime sector.” It really is scheduled to be held from February 10-12, 2023.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The Canadian cybersecurity enterprise explained the attacks are intended to concentrate on maritime-similar entities and the event’s website visitors by tricking the concept recipients into opening the seemingly harmless Microsoft Word document.

At the time the document is launched, a technique known as distant template injection is employed to fetch the next-phase payload from an actor-managed server which is configured to return the artifact only if the request is despatched from an IP handle positioned in Pakistan.

BlackBerry reported it located the server to be hosting two ZIP archive documents sans any password protections, 1 of which involves a Windows executable (updates.exe) that functions as a covert spying resource able of bypassing sandboxes and digital devices.

What is additional, the contents of the binary are encrypted with the XOR encryption algorithm, wherever the XOR important is “penguin.” The HTTP reaction that contains the backdoor also arrives with the identify parameter in the Articles-Disposition reaction header set to “getlatestnews.”

The identify NewsPenguin is a reference to the uncommon XOR key and the identify parameter, with BlackBerry locating no tactical overlaps that link the malware to any currently-identified threat actor or group.

An investigation of the domain hosting the payloads reveals that it has been registered considering the fact that June 30, 2022, indicating some degree of progress arranging for the marketing campaign whilst at the same time taking ways to iterate its toolset.

“As the goal is an function operate by the Pakistan Navy, it indicates that the threat actor is actively targeting govt companies, rather than this being a financially inspired attack,” BlackBerry explained.

Located this article fascinating? Comply with us on Twitter  and LinkedIn to read far more unique information we write-up.