Quick Heal\u2019s threat intelligence team recently uncovered evidence of an advanced persistent threat (APT) against Indian defence forces. Our analysis shows that many old campaigns and attack in the past one year relate to \u2018Operation SideCopy\u2019 by common IOCs.<\/p>\n
Key Findings<\/strong><\/p>\n The highlighted ones were sent to targets across Indian defence units and armed forces individuals.<\/p>\n We started tracking this campaign as it was targeting critical Indian organizations.<\/p>\n Traces of this operation can be tracked from early 2019 till date. Till now, we have observed 3 infection chain process.<\/p>\n Initial infection vector in two of the chains was LNK file, that came from a malspam. But in one case, we saw attackers making use of template injection attack and equation editor vulnerability (CVE-2017-11882) as the initial infection vector. Though the initial infection vector is different in the third case, the final payload is similar to the first two chains.<\/p>\n Below images will provide an overview of malware infection in victim machines.<\/p>\n Infection Chain \u2013 Version 1:<\/strong><\/p>\n Infection Chain \u2013 Version 2:<\/strong><\/p>\n Infection Chain \u2013 Version 3:<\/strong><\/p>\n We have provided an in-depth analysis of each of this module in our latest report which can be found here<\/a>.<\/p>\n The background and analysis in this paper provide complete forensic and useful details of our current thinking on the use of malware in this operation. We have provided all factors that lead to our attribution.<\/p>\n\n
![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2021\/07\/1.png\")
<\/p>\n![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2021\/07\/2.png\")
<\/p>\n![\"\"](\"https:\/\/www.fie.undef.edu.ar\/ceptm\/wp-content\/uploads\/2021\/07\/3.png\")
<\/p>\n