Mysterious Elephant Using Hajj-Themed Bait in Attacks

A South Asian threat actor identified as Mysterious Elephant by Knownsec 404 security researchers is using a Hajj-themed lure to trick victims into malicious payload disguised as a Windows file.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

The Knownsec 404 team in a report found that Mysterious Elephant is using the annual Islamic pilgrimage to Mecca, Saudi Arabia, phish victims and trick them into executing an upgraded version of Asyncshell malware disguised as a Microsoft Compiled HTML Help file.

Mysterious Elephant has remained active since 2022 and primarily targeted Pakistani victims. The group’s tactics are similar to other regional actors, including SideWinder, Confucius and Bitter.

The exact initial access vector is unknown, but the group likely uses phishing emails as it has in previous hacks. The attack involves a ZIP archive containing two files: a CHM file claiming to detail the Hajj policy for 2024 and a hidden executable file. Opening the CHM file triggers a decoy – a genuine PDF from Pakistan’s Ministry of Religious Affairs and Interfaith Harmony – while the hidden executable runs in the background.

The malware establishes a command shell on the victim’s system once executed, allowing attackers to maintain control through a concealed command-and-control infrastructure.

Researchers have identified up to four versions of Asyncshell, each capable of executing commands via cmd and PowerShell. The malware’s initial attack chains exploit a vulnerability in WinRAR, CVE-2023-38831 with a CVSS rating of 7.8, to initiate the infection.

The latest version, Asyncshell-v4, employs a base64 variant algorithm for obfuscating strings and disguises C2 communications as standard web service requests.

The malware also removes extensive log messages that further complicate detection by security tools.

The group, also known as APT-K-47, operates primarily out of South Asia and is suspected to be Chinese nation-state actors targeting countries such as Pakistan, Bangladesh and Turkey.

Asyncshell-v3 in July introduced the ability to decrypt configuration files dynamically, demonstrating continuous adaptation to evade detection.

Knownsec’s report said that Asyncshell is one of several tools employed by Mysterious Elephant. The group’s arsenal also includes ORPCBackdoor, walkershell, MSMQSPY and LastopenSpy, representing a diverse toolkit for cyberespionage.