Indian Air Force targeted by Malware

Researchers have uncovered a spying campaign that is potentially targeting the Indian Air Force with malware to steal information.

An unknown hacker is threatening with phishing emails, including a dangerous link that leads to a malware .zip file. The file is said to contain data for the Su-30 fighter jets, which India approved to purchase last year to boost its defense upgrade efforts.

Read more: Iranian hackers target researchers with custom malware

“Researchers at cybersecurity Cyble report that hackers appear to be exploiting this situation to attack Indian aviation professionals.”

This malware is a variant of Go Stealer, based on open-source malware found on GitHub. However, it includes additional features, such as targeting a variety of browsers — Firefox, Google Chrome, Edge , and Brave — and extracting data using Slack.

Slack's choice for covert communications exploits the platform's widespread use in corporate networks, researchers say, allowing for the convenient execution of malicious activities in concert.

The attacks were likely targeted, as hackers specifically focus on extracting login credentials and cookies from browsers.

This malware appears to have a strategic approach, aiming to obtain specific sensitive information from infected systems, the researchers said. This nature of the malware is carefully designed.

Cyble found it difficult to pin this campaign down to a specific threat actor, given the limited amount of information currently available. The Indian Air Force did not respond to a request for comment.

See also: AndroxGh0st malware botnet steals AWS, Azure, Office 365 credentials

The agency to have already been the victim of cyberattacks. The country's authorities linked the 2017 crash of an Indian Su-30 fighter jet to a cyberattack carried out by a foreign nation.

Source: therecord.media