DoNot Disturb: Indian APT Group’s Malware Mischief Hits European Ministries!
DoNot Team, also known as APT-C-35 or Mint Tempest, is an advanced persistent threat actor targeting European foreign affairs ministries with malware. They use sneaky spear-phishing emails and malware like LoptikMod to spy and steal data. Their operations suggest a strong focus on cyber espionage, now expanding into Europe.
Hot Take:
Looks like the DoNot Team is really living up to their name by not stopping their cyber mischief. These digital pranksters from India have set their sights on Europe, and it seems they’ve swapped out the curry for some spaghetti with their latest Italian Defense Attaché-themed ruse. With such a detailed phishing scheme, they could give any catfish a run for their money. But don’t worry, the Trellix team is serving justice on a silver platter with a side of malware analysis!
Key Points:
- DoNot Team (aka APT-C-35) is targeting European foreign affairs using malware.
- Malicious tools include backdoors like YTY and GEdit, delivered via spear-phishing.
- Phishing emails impersonate defense officials with fake Google Drive links.
- LoptikMod malware is used for data exfiltration and evades virtual environment analysis.
- Command-and-control server currently inactive, limiting current threat analysis.