Maritime Computer Emergency Response Team ADMIRAL dataset ADMIRAL dataset

Publicly disclosed information for this event

Index Number:
Title:
2023_002
A campaign is targeting attendees of an international conference.
Day Month Year Country Activity Incident Type
9 February 2023 Pakistan Organisation Spearphishing

Summary

According to the source, a previously unknown threat actor has emerged, targeting organizations in Pakistan through a sophisticated payload delivery method. The attacker capitalized on an international naval conference to deceive potential victims.

The attacker initiated their campaign by sending targeted phishing emails containing a weaponized document masquerading as an exhibitor manual for the conference. This document employed a remote template injection technique and embedded malicious Visual Basic for Applications (VBA) macro code to execute the next stage of the attack, ultimately leading to the final payload.

The final payload was an advanced espionage tool encrypted using XOR encryption with a unique "penguin" encryption key. Notably, the content-disposition response header name parameter is set to "getlatestnews" during the HTTP response. Consequently, this threat actor has been named NewsPenguin.

Victim

Pakistan

Claimed/Reported Threat Actor

NewsPenguin

Origin

Undisclosed

Main impact

Integrity

References

Recommendations to Organisation to reduce Spearphishing risks:

  • Implement advanced email filtering systems to detect and block spearphishing emails.
  • Educate employees about the dangers of spearphishing and how to identify suspicious emails.
  • Enforce strict email access controls and authentication measures.
  • Implement organizational measures to avoid scam.
  • Limit the use of social networks or unallowed medias for professional activities.
  • Monitor for unusual email activity, such as unexpected login attempts.
  • Work with your CSIRT organization to know the Tactics, Techniques and Procedures used.
Previous Next
Disclaimer: the data are provided as is. France Cyber Maritime and the M-CERT take no responsibility for the soundness, quality, precision, nor the eventual attribution made by the referenced URLs. We give a lot of respect and support to the victims of attacks.
Files generated on Thursday, 10th October 2024.
ADMIRAL is licensed under the Creative Commons CC-BY-NC license. Copyright © France Cyber Maritime 2024.