ESET researchers have uncovered recent campaigns and an updated threat arsenal of the infamous APT group Donot Team (also known as APT-C-35 and SectorE02). According to research findings, the group is very persistent and has consistently targeted the same organizations for at least the last two years.
For this research, ESET monitored Donot Team for more than a year from September 2020 to October 2021. According to ESET telemetry, the APT group focuses on a small number of targets primarily in South Asia — Bangladesh, Sri Lanka, Pakistan and Nepal. However, targeting embassies of these countries in other regions, such as the Middle East, Europe, North America, and Latin America, is not outside the group’s realm. These attacks are focused on government and military organizations, Ministries of Foreign Affairs, and embassies and are motivated by cyberespionage.
Donot Team is a threat actor operating since at least 2016 that is known for targeting organizations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region.
“We have been closely following the activities of Donot Team, and have traced several campaigns that leverage Windows malware derived from the group’s signature yty malware framework,” says ESET researcher Facundo Muñoz, who led the investigation into the group’s activities.
The main purpose of the “yty” malware framework is to collect and exfiltrate data. The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset. These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.
According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months. The spearphishing emails have malicious Microsoft Office documents attached that the attackers use to deploy their malware.
Interestingly, the emails that ESET researchers were able to retrieve and analyze did not show signs of spoofing. “Some emails were sent from the same organizations that were being attacked. It’s possible that the attackers may have compromised the email accounts of some of their victims in earlier campaigns, or the email server used by those organizations,” says Muñoz.
In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical. ESET researchers have decided to call one of the variants DarkMusical because of the names the attackers chose for their files and folders: many are western celebrities or characters in the movie High School Musical. This variant was used in campaigns targeting military organizations in Bangladesh and Nepal.