The threat actor everyone's been talking about, Mysterious Elephant, has been caught using some fancy new malware called Asyncshell, according to this cybersecurity team called Knownsec 404. They've been using sneaky tricks like making it look like it's all about the Hajj to fool people into clicking on bad stuff.
Mysterious Elephant, or APT-K-47, has been around for a bit, starting in 2022, and they've mostly been after folks in Pakistan. They've got some techy moves that remind experts of other groups like SideWinder, Confucius, and Bitter.
In October 2023, they were part of this big spear-phishing thing where they sent out emails that looked important but actually had a backdoor called ORPCBackdoor. Now, they're up to some new stuff, and it's kinda like a game of hide and seek with a computer.
They start by sending a ZIP file with a fake Hajj policy doc for 2024 inside. But, surprise! There's also a sneaky little program hiding in there too. When you open the CHM file, it shows you a real PDF from the Pakistani government, but in the background, it's secretly running the bad file.
The malware is like a cheat code for hackers. It opens up a command prompt on your computer and lets them control it from far away. Knownsec 404 found out that there are four versions of Asyncshell, and the Elephant people have been using it a lot.
These clever hackers have been updating their game plan, switching from using TCP to HTTPS to talk to their control server and hiding the decoy doc with some old school Visual Basic tricks. It's like they're playing a game of hide and seek with the code.
The team that's keeping an eye on them said that this group really loves using Asyncshell and keeps making it better. They've gone from version to version, always changing the way they hide their tracks. It's like they're playing a game of cat and mouse with security guys.
So, APT-K-47 is kind of a big deal in the cyber-world, and they're always finding new ways to sneak into computers and do their thing. It's super important to stay safe and watch out for emails that might be too good to be true.