NCSC-TAD-2106-005
Severity Level: Critical
Malware
Reference No.: NCSC-TAD-2106-005CVSS 0
TA402 Attacks Governments in The Middle East
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- N/A
Overview
A threat group known as TA402 is targeting government institutions in the Middle East by sending malicious emails containing links or Arabic-language PDF attachments with geopolitical themes. The campaign uses geofenced URLs to deliver password-protected RAR files containing LastConn malware. LastConn is a backdoor that allows the threat actors to run arbitrary commands, take screenshots, and exfiltrate them via Dropbox.
Affected Technologies
- Computers with Arabic language packs installed
- Dropbox — used for data exfiltration
Mitigation and Immediate Actions
- 01
Verify the target sites SSL credebtials.
- 02
Watch out for shortened links.
- 03
Be wary of Suspicious Attachments.
- 04
Never click on hyperlinks in email.
References
- Molerats APT renews phishing attack against Middle Eastern governments. (2021). Retrieved from CIO(opens in a new tab)
- Molerats Hackers Actively Targeting Middle East Governments. (2021). Retrieved from CYWARE SOCIAL(opens in a new tab)
- New TA402 Molerats Malware Targets Governments in the Middle East. (2021). Retrieved from Proofpoint(opens in a new tab)
- The return of TA402 Molerats APT after a short pause. (2021). Retrieved from Security Affairs(opens in a new tab)
Impacted Sectors
- Government Services