Espionage Campaign Targets Turkish Defense Industry

A suspected South Asian threat actor targeted a Turkish defense organization, deploying malware via a RAR archive and using alternate data streams to deliver remote access Trojans.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

The attack is the latest in a series of operations attributed to a group Proofpoint tracks as TA397, also known as “Bitter.”

Active for over a decade, the group has previously targeted multiple countries including China, India, Pakistan and Bangladesh, with a focus on government and defense sectors. The group’s use of methods such as alternate data streams and multi-stage delivery are part of a trend in cyber espionage operations that aim to bypass traditional security measures and maintain persistence within targeted networks.

TA397 attackers on Nov. 18 sent an email to a Turkish defense sector organization containing a compresses archive file with a decoy PDF detailing World Bank efforts in Madagascar. The archive contained a shortcut LNK file masquerading as a PDF. Once clicked, the shortcut file initiated the infection chain by running a PowerShell.

The malware also created a scheduled task on the target machine that persistence. The task pulls down additional malicious payloads. The threat group ultimately deploys espionage-focused remote access Trojans WmRAT and MiyaRAT, said Proofpoint. WmRAT, a remote access tool written in C++, allows attackers to gather host information, take screenshots and issue arbitrary commands. MiyaRAT, the newer malware of the two, has similar functionality but is more sophisticated and possibly reserved for high-value targets.

The attackers used alternate data streams to avoid detection and smuggle in the malware. ADS is a feature in the NTFS file system used by Windows that allow additional data to be attached to a file without altering its visible size or appearance.

“Native Windows utilities hide ADS sections by default, making them effectively invisible to users and allowing the attack to be even more furtive. This highlights how advanced persistent threat actors continuously evolve their capabilities to gain access to organizations,” Proofpoint threat researcher Nick Attfield told Information Security Media Group.

If the victim opens the LNK file, one data stream executes code to download a decoy file from the World Bank’s website, while another stream carries a Base64-encoded PowerShell script. This script opens the lure document and also creates a scheduled task that retrieves the final-stage payloads from the domain jacknwoods.com.