Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal

Text acquired from the source

Evento MISP pubblicato con TLP:CLEAR: Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal. Report from - [URL rimossa] (1644251515) # Investigating APT36 or Earth Karkaddan’s Attack Chain and @[tag](misp-galaxy:financial-fraud="Malware") Arsenal We investigated the most recent activities of APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, and discuss its use of CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, @[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="Crimson")")") RAT. By: Trend Micro January 24, 2022 Read time: ( words) APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, has historically targeted Indian military and diplomatic resources. This APT group (also referred to as Operation C-Major, PROJECTM, Mythic Leopard, and Transparent Tribe) has been known to use social engineering and phishing lures as an entry point, after which, it deploys the @[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="Crimson")")") RAT malware to steal information from its victims. In late 2021, we saw the group leverage CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, @[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="@[tag](misp-galaxy:mitre-malware="Crimson")")"