Pierluigi Paganini
February 25, 2023
Broadcom Symantec researchers have reported that a previously unknown threat actor, tracked as Clasiopa, that is using a distinct toolset in attacks aimed at materials research organizations in Asia.
At the time of this writing, the infection vector used by Clasiopa is yet to be discovered, the experts believe that the attackers gain access through brute force attacks on Internet-facing servers.
According to the experts, the threat actor checked the IP addresses of the computers they were on using, they also attempted to disable Symantec Endpoint Protection (SEP) by stopping the SepMasterService.
The attackers used two legitimate software packages, the HCL Domino (formerly IBM Domino) and the Agile DGS and Agile FD servers. The experts noticed that both the Domino and Agile software appear to be using old certificates and the Agile servers use old vulnerable libraries.
The arsenal of the Clasiopa group includes:
The experts have yet to determine the origin of the hacking group and its motivation, but evidence collected by Symantec suggests it is based in India.
The researchers noticed a Hindi mutex used in the Atharvan backdoor is “SAPTARISHI-ATHARVAN-101”. Atharvan is a legendary Vedic sage of Hinduism. The backdoor also sends a post request to a C&C server with the arguments:
One of the passwords used by the threat actors for a ZIP archive was “iloveindea1998^_^”.
“While these details could suggest that the group is based in India, it is also quite likely that the information was planted as false flags, with the password in particular seeming to be an overly obvious clue.” concludes the report which also includes Indicators of Compromise (IoCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Clasiopa)
