{
  "name": "New Pakistan-based Cyber Espionage Group\u2019s Year-Long Campaign Targeting Indian Defense Forces with Android Malware",
  "slug": "new-pakistan-based-cyber-espionage-groups-year-long-campaign-targeting-indian-defense-forces-with-android-malware",
  "description": "CYFIRMA researchers identified an Android malware campaign, active for over a year, targeting Indian defense personnel by an unidentified Pakistan-based cyber espionage group. The threat actor utilized Spynote or a modified version called Craxs Rat, obfuscating the app with high complexity. Through social engineering tactics like impersonating senior officers and distributing the malware via WhatsApp, the group aimed to gain access to victims' contacts, call logs, SMS, and potentially screen monitoring capabilities.",
  "published": "2024-05-06T06:47:16+00:00",
  "created_at": "2024-05-06T06:47:16+00:00",
  "modified_at": "2024-05-06T07:29:02+00:00",
  "created_at_opencti": "2024-05-06T06:47:16+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-03",
    "2024-05-04",
    "2024-05-05",
    "2024-05-06",
    "android",
    "craxs rat",
    "defense",
    "espionage",
    "india",
    "malware",
    "pakistan",
    "spynote"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "38.92.47.116"
      },
      {
        "id": "",
        "name": "6c9a7e15d666fd61f62f1802d79782753ba25aaa76ecc86401658807f5d41503"
      },
      {
        "id": "",
        "name": "78625e72074eee611866ab04ae1935f2152ed695d3adcd68061d10386170668b"
      }
    ],
    "malware": [
      {
        "id": "4b693443-fad8-4ea2-bdf6-19c38eeef953",
        "name": "Craxs Rat",
        "slug": "craxs-rat"
      },
      {
        "id": "6a3ce444-584a-4a31-a751-dbbb59074db0",
        "name": "Spynote",
        "slug": "spynote"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f5c33c76-88b0-4031-9469-4a431e2f36ea",
        "name": "Unidentified Pakistan-based Group",
        "slug": "unidentified-pakistan-based-group"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Defense"
      }
    ]
  },
  "external_refs": [
    "https://www.cyfirma.com/research/new-pakistan-based-cyber-espionage-groups-year-long-campaign-targeting-indian-defense-forces-with-android-malware",
    "https://otx.alienvault.com/pulse/66389914e641a53a972fc95e"
  ]
}