Robust surveillance malware SEEDOOR was likely distributed via spear phishing emails about current events, defense issues and women
Unearthing a major breakthrough in cyber security space pertaining to the arch-rivals and neighbours – India and Pakistan, FireEye reveals a cyber threat operation in which malware was used against targets in India and Pakistan since at least 2013. The threat group behind the operation likely reached its targets by sending spear phishing emails with malware attachments. The lures used in the email were related to regional military and defence issues, often involving India-Pakistan relations and current events.
Based on the themes used in the emails and decoy documents, it is likely the threat actor intended to target Indian government and military personnel, as well as political dissidents in Pakistan, in order to collect intelligence.
“The line between real world conflict and cyber conflict continues to blur. Wherever you see geopolitical tensions you are likely to find cyber campaigns beneath the surface,” said Bryce Boland, FireEye chief technology officer for Asia Pacific. “We help organizations use threat intelligence to improve their defences against advanced attacks, because this forces threat actors to reinvest in new tools. When they pause to retool, it disrupts their operations.”
FireEye believes the group has a collaborative malware development environment and employs focused targeting. It appears to have operated consistently since 2013.
SEEDOOR: WITH PLUGINS FOR SOME TASKS
The threat actor’s malware has two primary components. SEEDOOR is often initially delivered to a target system by a downloader. SEEDOOR then creates a backdoor to the victim’s system. SEEDOOR’s built-in functionality includes interacting with the file system, simulating mouse clicks, starting and terminating processes, transferring files, making recordings and screenshots of the desktop, recording sound from a microphone, recording and taking snapshots from webcams, and in some cases collecting Microsoft Outlook emails and attachments.
TARGETING MAY REFLECT DIPLOMATIC RELATIONSHIPS
The significant use of Pakistani infrastructure for command and control, the nature of lure themes targeting Pakistani separatists and Indian military entities, and borrowed news titles from prominent Pakistan news outlets may indicate a potential Pakistani threat sponsor.
