After two years of research and study, a Chinese cybersecurity company discovered that an advanced persistent threat (APT) company founded in India with the regulation name “Confucius” had launched fresh attacks on the Pakistani government and military organizations.
Chinese cybersecurity company Antiy described to the Global Times on Tuesday that the group’s prematurely aggression can be outlined back to 2013. It primarily targeted nations, troops and power sectors of neighbouring countries like China, Pakistan and Bangladesh to swipe sensitive data.
The group was named “Confucius” by global cybersecurity members. Li Bosong, chief engineer of Antiy group, the company uses the command “Confucius says” to produce its attacks.
“This indicates that the hackers have learned Chinese civilization during their constant attacks on China,” Li said, stating that the company is good at operating spear-phishing e-mails and phishing websites, jointly with remarkable social engineering efforts to attack targets.
Political and monetary profits move the group’s actions. It swipes core data or harms the essential infrastructure talents of its marks. Their aggression can have a natural effect outside the network.
According to Antiy CERT, it caught the company’s invasions against the Pakistani government and military installations when it drafted the raids from the recommendation of the South Asian subcontinent in 2021. The group performs in the name of the working staff from the Pakistani government and mails targeted lance phishing e-mails. Once the recipients are unrestricted or download the documents, Trojan horse programs are installed into the machine, robbing all the secret information.
Antiy company found that in June 2021, the group used the malicious file with scopes related to the list of those who died in the Pakistani military to lead aggression and in February 2022, it used the file on the vaccination situation of the Pakistani administration attendants to complete attacks, according to Li.
The cyberpunks install different kinds of harmful software in spear-phishing e-mails and deceive the marks into spreading the links.
Antiy has comprehensively examined the selections of the group’s attacks and saw that the hackers transferred tools and codes with another APT group, SideWinder.
It is transmitted for Indian APT groups to share tools and codes. Previously, international cybersecurity companies announced that the APT group codenamed “Confucius” also shared guides with other Indian groups like Urpage, Li said.
The aggression has caught the attention of Pakistani sovereignty. The Pakistani National Telecom & Information Technology Security Board has published a nationwide alert telling that hackers are sending spear phishing e-mails under the name of the prime minister’s office and call for administrators and the crowd to stay awake and not to provide any information via e-mails or social media platforms.