{
  "name": "Operation Celestial Force employs mobile and desktop malware to target Indian entities",
  "slug": "operation-celestial-force-employs-mobile-and-desktop-malware-to-target-indian-entities",
  "description": "Cisco Talos is disclosing a new malware campaign called 'Operation Celestial Force' conducted by a Pakistani nexus of threat actors called 'Cosmic Leopard'. This multi-year operation has been targeting Indian entities and individuals since at least 2018, employing the use of GravityRAT (an Android and Windows malware) and HeavyLift (a Windows malware loader). The campaigns are administered by a tool called GravityAdmin, which manages multiple codenamed campaigns simultaneously. The operation utilizes spear phishing and social engineering to infect targets, continuously expanding its malware suite, indicating a high degree of success.",
  "published": "2024-06-14T06:31:22+00:00",
  "created_at": "2024-06-14T06:31:22+00:00",
  "modified_at": "2024-06-14T07:11:32+00:00",
  "created_at_opencti": "2024-06-14T06:31:22+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-14",
    "espionage",
    "gravityrat",
    "heavylift",
    "surveillance",
    "targeted attacks"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://zclouddrive.com/system/clouddrive/"
      },
      {
        "id": "",
        "name": "https://zclouddrive.com/downloads/CloudDrive_Setup_1.0.1.exe"
      },
      {
        "id": "",
        "name": "https://zclouddrive.com/system/546F9A.php"
      },
      {
        "id": "",
        "name": "https://www.sexyber.net/downloads/7ddf32e17a6ac5ce04a8ecbf782ca509/Sexyber-1.0.0.zip"
      },
      {
        "id": "",
        "name": "https://www.craftwithme.uk/cwmb/d26873c6.php"
      },
      {
        "id": "",
        "name": "https://www.craftwithme.uk/cwmb/craftwithme/strong_client.php"
      },
      {
        "id": "",
        "name": "https://www.craftwithme.uk/cwmb/craftwithme/"
      },
      {
        "id": "",
        "name": "https://ux.androidwebkit.com/kangaroo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "https://tl37.officelibraries.com/resauth.php/"
      },
      {
        "id": "",
        "name": "https://tl37.officelibraries.com/opex/13942BA7.php"
      },
      {
        "id": "",
        "name": "https://tl37.officelibraries.com/Sier/resauth.php"
      },
      {
        "id": "",
        "name": "https://tl37.officelibraries.com/MicrosoftUpdates/741bbfe6.php"
      },
      {
        "id": "",
        "name": "https://tl37.officelibraries.com/MsWordUpdates/c47d1870.php"
      },
      {
        "id": "",
        "name": "https://sni1.androidmetricsasia.com/voilet/8a99d28c.php"
      },
      {
        "id": "",
        "name": "https://sexyber.net/downloads/7ddf32e17a6ac5ce04a8ecbf782ca509/Sexyber-1.0.0.zip"
      },
      {
        "id": "",
        "name": "https://sdk2.sdklibraries.com/golf/c6cf642b.php"
      },
      {
        "id": "",
        "name": "https://moon.playstoreapi.net/indigo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "https://library.androidwebkit.com/kangaroo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "https://jupiter.playstoreapi.net/indigo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "https://jupiter.playstoreapi.net/RB/e7a18a38.php"
      },
      {
        "id": "",
        "name": "https://jun.javacdnlib.com/Quebec/5be977ac.php"
      },
      {
        "id": "",
        "name": "https://jre.jdklibraries.com/hotriculture/671e00eb.php"
      },
      {
        "id": "",
        "name": "https://download.webbucket.co.uk/webbucket/strong_client.php"
      },
      {
        "id": "",
        "name": "https://download.webbucket.co.uk/webbucket/"
      },
      {
        "id": "",
        "name": "https://download.webbucket.co.uk/A0B74607.php"
      },
      {
        "id": "",
        "name": "https://download.teraspace.co.in/teraspace/"
      },
      {
        "id": "",
        "name": "https://download.teraspace.co.in/78181D14.php"
      },
      {
        "id": "",
        "name": "https://download.sexyber.net/sexyber/sexyberC.php"
      },
      {
        "id": "",
        "name": "https://download.sexyber.net/0fb1e3a0.php"
      },
      {
        "id": "",
        "name": "https://download.rockamore.co.uk/m2c/m_client.php"
      },
      {
        "id": "",
        "name": "https://download.cvscout.uk/cvscout/cvstyler_client.php"
      },
      {
        "id": "",
        "name": "https://download.cvscout.uk/cvscout/"
      },
      {
        "id": "",
        "name": "https://download.cvscout.uk/c9a5e83c.php"
      },
      {
        "id": "",
        "name": "https://dl01.windowsupdatecloud.com/opex/7ab24931.php"
      },
      {
        "id": "",
        "name": "https://dl01.mozillasecurity.com/resauth.php/"
      },
      {
        "id": "",
        "name": "https://dl01.mozillasecurity.com/Sier/resauth.php"
      },
      {
        "id": "",
        "name": "https://dl01.mozillasecurity.com/MicrosoftUpdates/6efbb147.php"
      },
      {
        "id": "",
        "name": "https://dl01.mozillasecurity.com/"
      },
      {
        "id": "",
        "name": "https://dev.androidadbserver.com/jurassic/6c67d428.php"
      },
      {
        "id": "",
        "name": "https://cloudieapp.net/cloudie.zip"
      },
      {
        "id": "",
        "name": "https://api1.androidsdkstream.com/foxtrot/61c10953.php"
      },
      {
        "id": "",
        "name": "https://api1.androidsdkstream.com/foxtrot/"
      },
      {
        "id": "",
        "name": "https://adb.androidadbserver.com/jurassic/6c67d428.php"
      },
      {
        "id": "",
        "name": "www.sexyber.net"
      },
      {
        "id": "",
        "name": "www.craftwithme.uk"
      },
      {
        "id": "",
        "name": "http://zclouddrive.com/system/clouddrive/"
      },
      {
        "id": "",
        "name": "http://zclouddrive.com/system/546F9A.php"
      },
      {
        "id": "",
        "name": "http://zclouddrive.com/downloads/CloudDrive_Setup_1.0.1.exe"
      },
      {
        "id": "",
        "name": "http://www.sexyber.net/downloads/7ddf32e17a6ac5ce04a8ecbf782ca509/Sexyber-1.0.0.zip"
      },
      {
        "id": "",
        "name": "http://www.craftwithme.uk/cwmb/d26873c6.php"
      },
      {
        "id": "",
        "name": "http://www.craftwithme.uk/cwmb/craftwithme/"
      },
      {
        "id": "",
        "name": "http://www.craftwithme.uk/cwmb/craftwithme/strong_client.php"
      },
      {
        "id": "",
        "name": "http://ux.androidwebkit.com/kangaroo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "http://tl37.officelibraries.com/resauth.php/"
      },
      {
        "id": "",
        "name": "http://tl37.officelibraries.com/opex/13942BA7.php"
      },
      {
        "id": "",
        "name": "http://tl37.officelibraries.com/Sier/resauth.php"
      },
      {
        "id": "",
        "name": "http://tl37.officelibraries.com/MsWordUpdates/c47d1870.php"
      },
      {
        "id": "",
        "name": "http://sni1.androidmetricsasia.com/voilet/8a99d28c.php"
      },
      {
        "id": "",
        "name": "http://tl37.officelibraries.com/MicrosoftUpdates/741bbfe6.php"
      },
      {
        "id": "",
        "name": "http://sexyber.net/downloads/7ddf32e17a6ac5ce04a8ecbf782ca509/Sexyber-1.0.0.zip"
      },
      {
        "id": "",
        "name": "http://sdk2.sdklibraries.com/golf/c6cf642b.php"
      },
      {
        "id": "",
        "name": "http://moon.playstoreapi.net/indigo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "http://library.androidwebkit.com/kangaroo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "http://jupiter.playstoreapi.net/indigo/8a99d28c.php"
      },
      {
        "id": "",
        "name": "http://jupiter.playstoreapi.net/RB/e7a18a38.php"
      },
      {
        "id": "",
        "name": "http://jun.javacdnlib.com/Quebec/5be977ac.php"
      },
      {
        "id": "",
        "name": "http://jre.jdklibraries.com/hotriculture/671e00eb.php"
      },
      {
        "id": "",
        "name": "http://download.webbucket.co.uk/webbucket/strong_client.php"
      },
      {
        "id": "",
        "name": "http://download.webbucket.co.uk/webbucket/"
      },
      {
        "id": "",
        "name": "http://download.teraspace.co.in/teraspace/"
      },
      {
        "id": "",
        "name": "http://download.webbucket.co.uk/A0B74607.php"
      },
      {
        "id": "",
        "name": "http://download.teraspace.co.in/78181D14.php"
      },
      {
        "id": "",
        "name": "http://download.sexyber.net/0fb1e3a0.php"
      },
      {
        "id": "",
        "name": "http://download.sexyber.net/sexyber/sexyberC.php"
      },
      {
        "id": "",
        "name": "http://download.rockamore.co.uk/m2c/m_client.php"
      },
      {
        "id": "",
        "name": "http://download.cvscout.uk/cvscout/"
      },
      {
        "id": "",
        "name": "http://download.cvscout.uk/cvscout/cvstyler_client.php"
      },
      {
        "id": "",
        "name": "http://download.cvscout.uk/c9a5e83c.php"
      },
      {
        "id": "",
        "name": "http://dl01.mozillasecurity.com/resauth.php/"
      },
      {
        "id": "",
        "name": "http://dl01.windowsupdatecloud.com/opex/7ab24931.php"
      },
      {
        "id": "",
        "name": "http://dl01.mozillasecurity.com/Sier/resauth.php"
      },
      {
        "id": "",
        "name": "http://dl01.mozillasecurity.com/MicrosoftUpdates/6efbb147.php"
      },
      {
        "id": "",
        "name": "http://dl01.mozillasecurity.com/"
      },
      {
        "id": "",
        "name": "http://dev.androidadbserver.com/jurassic/6c67d428.php"
      },
      {
        "id": "",
        "name": "http://cloudieapp.net/cloudie.zip"
      },
      {
        "id": "",
        "name": "http://api1.androidsdkstream.com/foxtrot/61c10953.php"
      },
      {
        "id": "",
        "name": "http://api1.androidsdkstream.com/foxtrot//DataX/"
      },
      {
        "id": "",
        "name": "http://api1.androidsdkstream.com/foxtrot/"
      },
      {
        "id": "",
        "name": "http://adb.androidadbserver.com/jurassic/6c67d428.php"
      },
      {
        "id": "",
        "name": "ux.androidwebkit.com"
      },
      {
        "id": "",
        "name": "tl37.officelibraries.com"
      },
      {
        "id": "",
        "name": "sni1.androidmetricsasia.com"
      },
      {
        "id": "",
        "name": "sdk2.sdklibraries.com"
      },
      {
        "id": "",
        "name": "moon.playstoreapi.net"
      },
      {
        "id": "",
        "name": "library.androidwebkit.com"
      },
      {
        "id": "",
        "name": "jupiter.playstoreapi.net"
      },
      {
        "id": "",
        "name": "jun.javacdnlib.com"
      },
      {
        "id": "",
        "name": "download.webbucket.co.uk"
      },
      {
        "id": "",
        "name": "download.teraspace.co.in"
      },
      {
        "id": "",
        "name": "download.sexyber.net"
      },
      {
        "id": "",
        "name": "download.rockamore.co.uk"
      },
      {
        "id": "",
        "name": "download.cvscout.uk"
      },
      {
        "id": "",
        "name": "dl01.windowsupdatecloud.com"
      },
      {
        "id": "",
        "name": "dl01.mozillasecurity.com"
      },
      {
        "id": "",
        "name": "api1.androidsdkstream.com"
      },
      {
        "id": "",
        "name": "zclouddrive.com"
      },
      {
        "id": "",
        "name": "windowsupdatecloud.com"
      },
      {
        "id": "",
        "name": "webbucket.co.uk"
      },
      {
        "id": "",
        "name": "teraspace.co.in"
      },
      {
        "id": "",
        "name": "sexyber.net"
      },
      {
        "id": "",
        "name": "sdklibraries.com"
      },
      {
        "id": "",
        "name": "playstoreapi.net"
      },
      {
        "id": "",
        "name": "rockamore.co.uk"
      },
      {
        "id": "",
        "name": "officelibraries.com"
      },
      {
        "id": "",
        "name": "jdklibraries.com"
      },
      {
        "id": "",
        "name": "javacdnlib.com"
      },
      {
        "id": "",
        "name": "cvscout.uk"
      },
      {
        "id": "",
        "name": "craftwithme.uk"
      },
      {
        "id": "",
        "name": "cloudieapp.net"
      },
      {
        "id": "",
        "name": "androidsdkstream.com"
      },
      {
        "id": "",
        "name": "androidwebkit.com"
      },
      {
        "id": "",
        "name": "androidmetricsasia.com"
      },
      {
        "id": "",
        "name": "androidadbserver.com"
      },
      {
        "id": "",
        "name": "jre.jdklibraries.com"
      },
      {
        "id": "",
        "name": "dev.androidadbserver.com"
      },
      {
        "id": "",
        "name": "adb.androidadbserver.com"
      },
      {
        "id": "",
        "name": "da3907cf75662c3401581a5140831f8b2520a4c3645257b3860c7db94295af88"
      },
      {
        "id": "",
        "name": "c00cedd6579e01187cd256736b8a506c168c6770776475e8327631df2181fae2"
      },
      {
        "id": "",
        "name": "8d458fb59b6da20e1ba1658bb4a1f7dbb46d894530878e91b64d3c675d3d4516"
      },
      {
        "id": "",
        "name": "8e9bcc00fc32ddc612bdc0f1465fc79b40fc9e2df1003d452885e7e10feab1ee"
      },
      {
        "id": "",
        "name": "838fd5d269fa09ef4f7e9f586b6577a9f46123a0af551de02de78501d916236d"
      },
      {
        "id": "",
        "name": "69414a0ca1de6b2ab7b504a507d35c859fc5a1b8e0b3cf0c6a8948b2f652cbe9"
      },
      {
        "id": "",
        "name": "63a76ca25a5e1e1cf6f0ca8d32ce14980736195e4e2990682b3294b125d241cf"
      },
      {
        "id": "",
        "name": "688c8e4522061bb9d82e4c3584f7ef8afc6f9e07e2374567755faad2a22e25b8"
      },
      {
        "id": "",
        "name": "5695c1e5e4b381844a36d8281126eef73a9641a315f3fdd2eb475c9073c5f4da"
      },
      {
        "id": "",
        "name": "380df073825aca1e2fdbea379431c2f4571a8c7d9369e207a31d2479fbc7be88"
      },
      {
        "id": "",
        "name": "4ebdfa738ef74945f6165e337050889dfa0aad61115b738672bbeda648a59dab"
      },
      {
        "id": "",
        "name": "36851d1da9b2f35da92d70d4c88ea1675f1059d68fafd3abb1099e075512b45e"
      },
      {
        "id": "",
        "name": "12d98137cd1b0cf59ce2fafbfe3a9c3477a42dae840909adad5d4d9f05dd8ede"
      },
      {
        "id": "",
        "name": "1382997d3a5bb9bdbb9d41bb84c916784591c7cdae68305c3177f327d8a63b71"
      },
      {
        "id": "",
        "name": "04e216f4780b6292ccc836fa0481607c62abb244f6a2eedc21c4a822bcf6d79f"
      },
      {
        "id": "",
        "name": "06b617aa8c38f916de8553ff6f572dcaa96e5c8941063c55b6c424289038c3a1"
      }
    ],
    "malware": [
      {
        "id": "96eb4f9e-0f4c-4215-8622-2ae16b1a2d0d",
        "name": "HeavyLift",
        "slug": "heavylift"
      },
      {
        "id": "663e2b71-592f-4637-adbc-a547c0f0a27f",
        "name": "GravityRAT - S0237",
        "slug": "gravityrat-s0237"
      }
    ],
    "intrusion_sets": [
      {
        "id": "91a9bafd-b231-46ed-a4ad-c86b2a0c19e1",
        "name": "Cosmic Leopard",
        "slug": "cosmic-leopard"
      }
    ],
    "attack_patterns": [
      {
        "id": "c01628ab-1819-4953-b2ef-8becbe23eaa5",
        "name": "T1597"
      },
      {
        "id": "7616ff60-a18f-4663-9824-b889aa01c8ce",
        "name": "T1588"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "29f7ff93-033b-4f8d-8691-5bcaa438c80f",
        "name": "T1592"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "India"
      }
    ]
  },
  "external_refs": [
    "https://blog.talosintelligence.com/cosmic-leopard",
    "https://otx.alienvault.com/pulse/666bffda98d55b50133f5b84"
  ]
}