By 
A hacking group has been linked to targeted attacks against Indian human rights activists, human rights defenders, academics, and lawyers in an attempt to plant "incriminating digital evidence."
The cybersecurity firm SentinelOne attributed the intrusions to a group which it dubbed as "ModifiedElephant." The group has been operational since at least 2012, and their activity aligns with Indian state interests.
The researchers stated that ModifiedElephant operates through the use of commercially available remote access trojans (RATs) and has potential ties to the commercial surveillance industry. The threat actor uses spear-phishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers.
The primary goal of ModifiedElephant is to facilitate long-term surveillance of targeted individuals, ultimately leading to the delivery of "evidence" on the victims' compromised systems with the goal of framing vulnerable opponents.
The attack chains involve infecting the targets using spear-phishing emails themed around topics related to activism, climate change, politics, and containing malicious Microsoft Office document attachments or links to files hosted externally that are weaponized with malware capable of taking control of victim machines.
In order to look legitimate the phishing emails includes fake body content with a forwarding history containing long lists of recipients, original email recipient lists with many seemingly fake accounts, or simply resending their malware multiple times using new emails or lure documents.
Unidentified commodity trojan targeting Android that enables the attackers to intercept and manage SMS and call data, wipe or unlock the device, perform network requests, and remotely administer the infected devices are also distributed via phishing mails.
Credit : SentinelOne
