Threat Intelligence Brief
Curated summary with source attribution
Source: ibm.com
Threat Risk: High
Victim: India’s energy sector and government agencies
Incident: A state-sponsored espionage campaign utilizing custom backdoors for data exfiltration.
Impact: Potential compromise of critical energy infrastructure and theft of strategic government intelligence.
Attacker: ITG27 (Mustang Panda)
Analysis: ITG27, a China-aligned espionage group, is utilizing a newly discovered VNC-capable backdoor called Havencode to target India’s energy and government sectors. Through the use of deception environments, analysts observed the actors conducting reconnaissance and harvesting credentials. The campaign integrates several malware families, including Claimloader and Toneshell, to maintain persistence and exfiltrate data via SFTP.
Recommendations: Implement robust network segmentation between IT and operational technology (OT) environments.; Deploy deception technology to identify and trap unauthorized lateral movement in real-time.; Monitor for anomalous SFTP exfiltration and unauthorized VNC connections to external IPs.
Source: IBM X-Force
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source