ESET research investigates Donot Team: Cyberespionage targeting military & governments in South Asia

ESET researchers have uncovered recent campaigns and an updated threat arsenal of the infamous APT group Donot Team (also known as APT-C-35 and SectorE02). According to research findings, the group is very persistent and has consistently targeted the same organisations for at least the last two years. For this research, ESET monitored Donot Team for more than a year from September 2020 to October 2021.

According to ESET telemetry, the APT group focuses on a small number of targets primarily in South Asia — Bangladesh, Sri Lanka, Pakistan and Nepal. However, targeting embassies of these countries in other regions, such as the Middle East, Europe, North America and Latin America, is not outside the group’s realm. These attacks are focused on government and military organisations, Ministries of Foreign Affairs and embassies and are motivated by cyberespionage.

Donot Team is a threat actor operating since at least 2016 that is known for targeting organisations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region.

“We have been closely following the activities of Donot Team and have traced several campaigns that leverage Windows malware derived from the group’s signature yty malware framework,” says ESET Researcher, Facundo Muñoz, who led the investigation into the group’s activities.

The main purpose of the “yty” malware framework is to collect and exfiltrate data. The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset. These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells and more.

According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months. The spearphishing emails have malicious Microsoft Office documents attached that the attackers use to deploy their malware.

Interestingly, the emails that ESET researchers were able to retrieve and analyse did not show signs of spoofing. “Some emails were sent from the same organisations that were being attacked. It’s possible that the attackers may have compromised the email accounts of some of their victims in earlier campaigns, or the email server used by those organisations,” says Muñoz.

In the latest blogpost, ESET has analysed two variants of the yty malware framework: Gedit and DarkMusical. ESET researchers have decided to call one of the variants DarkMusical because of the names the attackers chose for their files and folders: many are western celebrities or characters in the movie High School Musical. This variant was used in campaigns targeting military organisations in Bangladesh and Nepal.

For more information, visit: www.eset.com