Edward Kiledjian

In today's dynamic cybersecurity landscape, understanding nation-state cyber threats is essential for safeguarding organizations. This article provides an overview of Advanced Persistent Threat (APT) groups linked to Pakistan, their activities, and the broader implications for global cybersecurity.

Background

Over the past decade, Pakistan has been advancing its cyber capabilities for both defensive and offensive purposes. Although attributing cyberattacks can be difficult, several APT groups are believed to operate in alignment with Pakistani state interests, based on their targeting patterns, infrastructure, and other indicators.

Notable Pakistan-Linked APT Groups

Transparent Tribe (APT36)

Also known as: PROJECTM, Mythic Leopard, TEMP.Lapis

Active since at least 2013, Transparent Tribe mainly targets Indian government and military entities, as well as organizations in Afghanistan and other South Asian countries.

Key characteristics:

• Focuses on cyber espionage against Indian defence and government targets.
• Utilizes a mix of custom and publicly available malware.
• Engages in social engineering tactics, often exploiting geopolitical themes.

SideCopy

First observed in 2019, SideCopy derives its name from its infection chain, which mimics that of the SideWinder APT, an Indian-linked group. Some reports suggest that SideCopy may be a subdivision of Transparent Tribe.

Key characteristics:

• Primarily targets South Asian countries, particularly India and Afghanistan.
• Employs a variety of malware, including custom RATs and publicly available tools.
• Uses sophisticated social engineering in phishing campaigns.

APT-C-35 (DoNot Team)

Active since at least 2016, APT-C-35 is believed to be linked to Pakistani interests.

Key characteristics:

• Targets government and military organizations, especially in South Asia.
• Focuses on the Kashmir region due to ongoing territorial disputes.
• Utilizes custom malware and advanced phishing techniques.

Gorgon Group

Although not definitively linked to the Pakistani state, Gorgon Group is believed to operate from Pakistan and has conducted both cybercrime and targeted intrusion campaigns.

Key characteristics:

• Targets government organizations and commercial entities globally.
• Utilizes a diverse set of malware, including njRAT, NanoCore, and QuasarRAT.
• Employs sophisticated social engineering in phishing campaigns.

Common Tactics, Techniques, and Procedures (TTPs)

APT groups linked to Pakistan deploy a wide range of TTPs, many of which are shared across multiple groups. Here's a detailed breakdown of their common tactics:

Spear-phishing:

• Highly targeted emails with malicious attachments.
• Use of geopolitical themes, military topics, or current events as lures.
• Impersonation of legitimate organizations or individuals.

Malware diversity:

• Custom Remote Access Trojans (RATs), such as Crimson RAT (Transparent Tribe) and AllaKore RAT (SideCopy).
• Use of publicly available tools like njRAT, NanoCore, and QuasarRAT.
• Mobile malware targeting Android devices.

Social engineering:

• Elaborate schemes to trick targets into opening malicious files.
• Creation of fake websites mimicking legitimate government portals.
• Use of compromised or spoofed email accounts to increase credibility.

Exploitation of public-facing applications:

• Targeting vulnerabilities in web servers and content management systems.
• Exploitation of known vulnerabilities, particularly in Microsoft Office (e.g., CVE-2017-11882).

Living off the land:

• Use of legitimate system tools and software to evade detection.
• Abuse of PowerShell and Windows Management Instrumentation (WMI).

Persistence mechanisms:

• Use of scheduled tasks and Windows Registry modifications.
• Deployment of backdoors for long-term access.

Data exfiltration techniques:

• Use of custom exfiltration tools (e.g., Transparent Tribe’s "Limepad").
• Leveraging cloud storage services like Google Drive for data transfer.

Command and Control (C2) infrastructure:

• Use of compromised websites as C2 servers.
• Implementation of domain generation algorithms (DGAs).
• Leveraging legitimate services like Telegram for C2 communication.

Evasion techniques:

• Heavy use of obfuscation and encryption in malware.
• Implementing anti-analysis and anti-debugging features.
• Use of steganography to conceal malicious payloads.

Credential harvesting:

• Deployment of keyloggers and browser stealers.
• Creation of phishing pages mimicking government login portals.

Cross-platform malware:

• Development of malware in cross-platform languages like Python and Golang.
• Targeting both Windows and Linux systems, including custom Linux distributions used by Indian defence organizations.

Supply chain attacks:

• Compromising third-party software or update mechanisms.
• Targeting defence contractors and other entities in the supply chain of primary targets.

These TTPs highlight the sophisticated and evolving nature of Pakistan-linked APT groups. Their focus on specific geopolitical targets, especially in South Asia, and their continuous adaptation of tools and techniques make them a persistent threat in the region.

Targets and Motivations

The primary targets of Pakistan-linked APT groups include:

• Indian government agencies, particularly defence and military organizations.
• Think tanks and research institutions focused on South Asian geopolitics.
• Diplomatic missions and international organizations operating in the region.
• Critical infrastructure sectors in rival countries.

Their main motivations appear to be:

• Gathering military and strategic intelligence.
• Conducting surveillance on perceived adversaries and dissidents.
• Supporting Pakistan's geopolitical interests in the region.

Implications for Cybersecurity

Organizations, especially those operating in South Asia or involved in regional geopolitics, should:

1. Implement robust email security and phishing awareness training.
2. Regularly patch and update all systems, especially internet-facing applications.
3. Deploy and maintain endpoint detection and response (EDR) solutions.
4. Monitor for indicators of compromise (IoCs) associated with known Pakistan-linked APT groups.
5. Enhance security around sensitive military, diplomatic, and strategic information.

Conclusion

While Pakistan-linked APT groups may not receive as much attention as some other nation-state actors, they represent a significant and evolving threat, particularly in the South Asian region. As cybersecurity leaders, staying vigilant and adapting defences to counter these sophisticated adversaries is essential.