{"id":22771,"date":"2023-01-12T02:31:17","date_gmt":"2023-01-12T02:31:17","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=22771"},"modified":"2026-04-17T18:07:42","modified_gmt":"2026-04-17T18:07:42","slug":"analysis-of-cyber-attack-of-apt-organization-confucius-against-pakistans-intelligence-based-operation","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/analysis-of-cyber-attack-of-apt-organization-confucius-against-pakistans-intelligence-based-operation\/","title":{"rendered":"Analysis of Cyber Attack of APT Organization Confucius against Pakistan’s Intelligence-Based Operation"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Overview<\/strong><\/h2>\n\n\n\n

Affected by many factors, Pakistan has long suffered from serious local terrorism threats. The country has also taken counter-terrorism as an important national security strategy. In the second half of 2022, the Pakistani security forces carried out many intelligence-based operations (IBO) in Baluchistan, Khyber and North Waziristan, and killed many terrorists.<\/p>\n\n\n\n

Pakistan’s recent high-profile performance in counter-terrorism has attracted the attention of India. On November 30, 2022, NSFOCUS Security Labs spotted a cyber-attack against the armed forces in Multan, Pakistan. The attacker used the IBO action report in Lodhran District of Multan as bait to try to deliver a variant of the Trojan program to control the victim’s devices. After analysis, NSFOCUS Security Labs confirmed that the leader of the event was the Indian APT organization Confucius.<\/p>\n\n\n\n

About Confucius<\/strong><\/h2>\n\n\n\n

Confucius is an APT organization funded by India. It has been carrying out cyber-attacks since 2013, mainly targeting Pakistan, China and other neighboring countries of India. It has a strong interest in the military, government agencies, energy and other fields.<\/p>\n\n\n\n

Confucius uses both the Windows and Android Trojan programs to spy on the target to steal intelligence. The attack tools include SubBird, CharSpy and Hornbill, which have strong development and penetration capabilities.  <\/p>\n\n\n\n

In this attack, Confucius followed its common bait construction mode and used a new variant of the known attack tool MessPrint.<\/p>\n\n\n\n

Attack Process<\/strong><\/h2>\n\n\n\n

In this cyber attack, Confucius attackers constructed a phishing document named “IBO_Lodhran. doc” and a phishing document named US_Dept_of_State_Fund_Allocations_for_Pakistan.doc”, targeting the security forces and diplomatic government departments of Pakistan respectively.<\/p>\n\n\n\n

These phishing documents carry intelligence content with a certain degree of authenticity, induce the victim to start the editing function of the document through a pop-up message, and then implement an attack process of embedding a variant Trojan horse.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 1 pop-up message in phishing documents<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 2 Phishing document content：IBO_Lodhran.doc<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3 Phishing document content：US_Dept_of_State_Fund_Allocations_for_Pakistan.doc<\/p>\n\n\n\n

The typical attack process in this event is shown in the figure below.<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n

Figure 4 Typical attack process of this event<\/p>\n\n\n\n

When the macro in the above phishing document is executed, the document releases a file named gist.txt to the specified directory and set a scheduled task that runs every 30 minutes to run the file regularly.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Figure 5 Scheduled tasks set by phishing documents<\/p>\n\n\n\n

The gist.txt is a PowerShell trojan actually. It initiates a link first to a fixed path tcp:\/\/142.234.157[.] 195:8080 to test connectivity, and uploads the user name, computer name, mac address, system information and other contents of this machine as registration information; Then it downloads encrypted data from the fixed path http:\/\/microsoftonedriver[.] com: 8989\/enc.txt and decrypts it as VERSION.dll and uses rundll32 to load and execute.
The VERSION.dll is the main Trojan program used by Confucius in this event, and the CnC it connected is tcp:\/\/info-updates.ddns[.]net:8080.<\/p>\n\n\n\n

Trojan Analysis<\/strong><\/h2>\n\n\n\n

The main Trojan program VERSION.dll is a variant of a known attack component used by Confucius. To facilitate follow-up tracking, NSFOCUS Security Labs named the attack component MessPrint.<\/p>\n\n\n\n

Compared with previous versions, the MessPrint variant has changed greatly in terms of function and confrontation, and its main version number has also changed from 2.X.X to 3.1.0.<\/p>\n\n\n\n