Skip to main content
عربي
logo

NCSC-TAD-2306-001

Severity Level: Low
Malware

Reference No.: NCSC-TAD-2306-001CVSS 0

APT Group Targeting Governments in the Middle East and Africa

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Espionage attacks have been identified in the Middle East and Africa that target governmental sectors. The attackers’ objective is to get highly sensitive and confidential information, particularly information pertaining to political figures, military operations, and ministries of foreign affairs. The activity group that is currently being monitored for these attacks is CL-STA-0043. The expertise, adaptability, and victimology of this activity group point to a highly skilled APT threat actor, and it is assumed that this threat actor is a nation-state. While tracking and investigating CL-STA-0043, it was discovered that the attackers were using novel evasive tactics and tools, including an in-memory VBS implant to run a webshell covertly and a previously unseen unusual credential theft technique.

Mitigation and Immediate Actions

  1. 01

    Prevents the execution of known malicious malware and also prevents the execution of unknown malware using Behavioural Threat Protection and machine learning based on the Local Analysis module.

  2. 02

    Protects against credential gathering tools and techniques.

  3. 03

    Protects from threat actors dropping and executing commands from webshells using Anti Webshell Protection.

  4. 04

    Protects against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioural Threat Protection.

  5. 05

    Detects post-exploit activity, including credential-based attacks, with behavioural analytics.

References

Impacted Sectors

  • Government Services