SideCopy Exploiting WinRAR Flaw in Attacks Targeting Indian Government Entities

The Pakistan-joined menace actor recognised as SideCopy has been observed leveraging the modern WinRAR security vulnerability in its attacks targeting Indian federal government entities to deliver numerous remote obtain trojans such as AllaKore RAT, Ares RAT, and DRat.

Organization security agency SEQRITE described the campaign as multi-platform, with the attacks also created to infiltrate Linux systems with a suitable edition of Ares RAT.

SideCopy, lively because at minimum 2019, is recognised for its attacks on Indian and Afghanistan entities. It is suspected to be a sub-group of the Clear Tribe (ak APT36).

“Both of those SideCopy and APT36 share infrastructure and code to aggressively focus on India,” SEQRITE researcher Sathwik Ram Prakki reported in a Monday report.

Before this May perhaps, the team was connected to a phishing marketing campaign that took benefit of lures connected to India’s Defence Investigation and Progress Group (DRDO) to produce facts-stealing malware.

Since then, SideCopy has also been implicated in a established of phishing attacks concentrating on the Indian protection sector with ZIP archive attachments to propagate Action RAT and a new .NET-based mostly trojan that supports 18 various instructions.

The new phishing campaigns detected by SEQRITE entail two various attack chains, each individual targeting Linux and Windows running systems.

The previous revolves close to a Golang-primarily based ELF binary that paves the way for a Linux variation of Ares RAT that is capable of enumerating information, taking screenshots, and file downloading and uploading, between many others.

The second campaign, on the other hand, entails the exploitation of CVE-2023-38831, a security flaw in the WinRAR archiving tool, to set off the execution of destructive code, main to the deployment of AllaKore RAT, Ares RAT, and two new trojans identified as DRat and Essential RAT.

“[AllaKore RAT] has the performance to steal technique facts, keylogging, take screenshots, add & download data files, and just take the distant entry of the sufferer machine to deliver commands and upload stolen information to the C2,” Ram Prakki explained.

DRat is capable of parsing as many as 13 commands from the C2 server to get technique details, obtain and execute supplemental payloads, and accomplish other file functions.

The focusing on of Linux is not coincidental and is likely motivated by India’s determination to substitute Microsoft Windows with a Linux taste termed Maya OS across govt and protection sectors.

“Growing its arsenal with zero-day vulnerability, SideCopy continuously targets Indian defense businesses with different distant obtain trojans,” Ram Prakki said.

“APT36 is increasing its Linux arsenal frequently, where sharing its Linux stagers with SideCopy is noticed to deploy an open up-resource Python RAT known as Ares.”

Uncovered this posting attention-grabbing? Adhere to us on Twitter  and LinkedIn to study far more special written content we put up.

Some sections of this write-up are sourced from:
thehackernews.com