Commodity RAT Campaign Targets Government and Diplomatic Entities in Afghanistan and India
Summary
Cisco Talos details a campaign targeting Afghan and Indian entities with malicious documents exploiting CVE-2017-11882, custom document infectors, and RATs including dcRAT, QuasarRAT and AndroRAT.
Key points
- Malicious RTF documents exploited CVE-2017-11882 to deliver PowerShell scripts, loaders, and malware.
- A custom tool enumerated files and weaponized Office documents on removable, network, and other drives to spread the infection.
- Payloads included dcRAT and QuasarRAT for Windows, AndroRAT for Android, and—in some cases—a legitimate AnyDesk client.
- The RATs could enable remote shell access, file and process management, command execution, keylogging, and credential theft.
- Political, diplomatic, and humanitarian-themed lures and decoy images were used to target likely Afghan and Indian government and diplomatic entities.
- Talos assessed with moderate confidence that an actor using the A.R. Bunse identity operated behind the purported Pakistani IT firm Bunse Technologies.
Article Details
- Attack Vectors
- Malicious RTF documents exploit CVE-2017-11882 to execute PowerShell scripts and deliver malware.
- Custom infectors weaponize benign .doc, .docx, and .rtf files on removable, CD-ROM, or network drives with malicious OLE objects and embedded RTF content.
- C# downloaders and loaders retrieve or compile payloads, display decoy images, and execute RATs on victim endpoints.
- The campaign used political, government, diplomatic, and humanitarian-themed lures targeting entities in Afghanistan and India.
- Defensive Notes
- Cisco Talos recommends vigilance against automated proliferation through infected documents and commodity RATs.
- The article identifies Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Cisco Duo, and Snort rules as available protections or detection options.
- Snort SIDs 58356-58361 detect activity associated with this threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | af-gov[.]ml | Attacker-registered, Afghan government-themed domain used in the campaign. |
| DOMAIN | afghancdn[.]world | Actor-controlled domain used to host malware and serve a decoy image to infected victims. |
| DOMAIN | jayshreeram[.]cf | Attacker-registered domain used to host DcRAT and deliver malicious payloads. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe enumerator's collected file paths are exfiltrated to the C2.T1053.005 · Scheduled TaskA loader establishes persistence using a shortcut in the current user's Startup directory.T1055 · Process InjectionThe custom C# code is compiled and invoked within the loader or downloader process's memory.T1059.001 · PowerShellPowerShell scripts decode and execute staged payloads and download malware.T1083 · File and Directory DiscoveryThe custom file enumerator lists selected document types on endpoint drives.T1203 · Exploitation for Client ExecutionMalicious RTF documents exploit CVE-2017-11882 to execute code through vulnerable Microsoft Office.T1555.003 · Credentials from Web BrowsersThe browser credential stealer attempts to gather login data from named browsers.
CVE
CVE-2012-11882The malicious RTF would exploit CVE-2012-11882 — a code execution vulnerability in Office — to execute a malicious PowerShell command (called Stage 1 here) to extract and execute the next stage PowerShell script (StageCVE-2017-11882These attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.
People
Threat Actors
Malware
AndroidRATThese attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.AndroRATAndroRATDCRatThese attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.Jenxcustarget executables such as EXEs to infect targets with malicious code. Other script-based worms, such as Jenxcus, would replace the target-benign documents on a removable drive with malicious shortcuts to ensure theQuasarRATThese attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.
Vendors
CiscoCisco Talos recently discovered a threat actor using political and government-themed malicious domains to target entities in India and Afghanistan.MicrosoftThese attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.
Products
AnyDeskSo far, we’ve observed the delivery of three types of payloads from the remote locations discovered in this phase of the campaign: DcRAT, QuasarRAT and a legitimate copy of the remote desktop client AnyDesk.BraveBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Google ChromeBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.Microsoft EdgeBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.Microsoft OfficeThese attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office — and AndroidRAT to target mobile devices.Mozilla FirefoxBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.OperaBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.Opera GXBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.YandexBrowserBrave, Google Chrome, Opera, Opera GX, Microsoft Edge, YandexBrowser and Mozilla Firefox.
Tools
certutil.exeStage 1 base64 decodes the next-stage payload via certutil.exe, drops it to disk and executes it.cmd.exeThe file enumerator lists files with specific file extensions via cmd.exe for every Fixed drive on the system. This information is recorded into a file on disk and subsequently exfiltrated to the C2. The filesPowerShellThe infection chains consist of malicious RTF documents and PowerShell scripts that distribute malware to victims.
Countries
Industries
Diplomaticto their victims. Their malicious lures also contained themes related to Afghan entities, specifically diplomatic and humanitarian efforts. We assess with high confidence that the threat actor behind these attacks isGovernmentCisco Talos recently discovered a threat actor using political and government-themed malicious domains to target entities in India and Afghanistan.HumanitarianTheir malicious lures also contained themes related to Afghan entities, specifically diplomatic and humanitarian efforts. We assess with high confidence that the threat actor behind these attacks is an individual