In a sophisticated cyber espionage campaign, threat actors are actively targeting Indian government personnel using decoy documents referencing the recent Pahalgam attack. The malware campaign appears specifically tailored to compromise sensitive government information, with particular focus on defense, intelligence, and law enforcement agencies. The documents, disguised as official briefings or intelligence reports on the Pahalgam situation, prompt users to “Enable Content” to view supposedly protected information, triggering the execution of hidden malicious code. These emails appear to originate from legitimate government agencies, making them particularly convincing to unsuspecting officials seeking information about the security situation. Their investigation uncovered a previously undocumented Remote Access Trojan (RAT) that establishes persistence and communicates with command-and-control servers reportedly linked to a nation-state threat actor with a history of targeting Indian government institutions. The malicious campaign, discovered in early May 2025, utilizes spear-phishing emails with attachments designed to exploit recipients’ interest in security developments related to the incident. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The researchers noted that this campaign appears to be the work of a highly sophisticated adversary with deep knowledge of Indian government operations. The malware then collects system information and begins exfiltrating sensitive data while attempting to move laterally within government networks. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Seqrite researchers identified the campaign after detecting unusual network traffic patterns from government networks. Initial analysis reveals that the attacks begin with Microsoft Word documents containing embedded macros that, when enabled, deploy a multi-stage malware payload.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 14:05:04 +0000