Commodity RAT Malware Discovered Targeting Afghanistan and India

Written by Supriyo Chatterji
Published on October 20, 2021

A threat actor using malicious political- and government-themed websites to target Afghanistan and India. The activities are perpetrated via malicious RTF documents for delivering a number of commodity malware to target systems. They are usually exploiting a Microsoft Office CVE-2017-11882 stack overflow vulnerability which allows for arbitrary code execution.

They usually run their campaign in four phases:

The actor registered several malicious domains focusing on political and government themes and used them to distribute malware by delivering payloads to targeted devices and systems. These malware datasets contained information of organizations operating in Afghanistan, particularly relating to diplomatic and humanitarian efforts.

More specifically, they are using malicious RTF documents and PowerShell scripts chain to send out malware to target systems and C#-based downloader binaries for sending out this malware using decoy images to mask their actual code scripts. Experts say the actions indicate that all these activities are orchestrated by one single individual. They are using the cover of a Pakistani IT firm named "Bunse Technologies."

This actor is a perfect example of individual agents using political and humanitarian fronts to ensnare victims via commodity malware. In this particular case, commodity RAT families are the attacking malware of choice for infecting targets. The RATs offer multiple function options which facilitate exerting total control over remote devices.

This process persists from the initial recon tasks to any other command executions on remote devices along with system-wide data exfiltration. RAT and similar malware bundles serve as very useful platforms for initiating attacks against targets over any network.

Moreover, these directly available features allow for prompt attack launches without needing elaborate configuration. With the use of custom file enumerator and infector modules along with immediate launch capabilities, attackers can even pursue infecting benign and trusted documents for even more widespread infection.

Prefabricated and compiled commodity malware has been growing in popularity for some time now. It offers a lot of uptime thanks to its ready-to-redeploy malware-delivering mechanisms. They also provide streamlined infection chains with fairly hard-to-detect entry points, which grants them a potentially high success rate. Organizations have to maintain a strict vulnerability coverage protocol which mainly involves ensuring all software is up-to-date to minimize gaps in device security to deter possible attacks from these highly motivated mechanisms.

A previously unknown hacker group called Harvester that seems nation-state-backed was discovered recently, and it's as well targeting South Asia in its espionage activities, with a focus on Afghanistan.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: