{"id":41554,"date":"2023-05-29T20:11:25","date_gmt":"2023-05-29T17:11:25","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=41554"},"modified":"2026-03-28T03:22:47","modified_gmt":"2026-03-28T00:22:47","slug":"dont-expect-any-howls-goldenjackal-cyber-gang-spying-on-diplomatic-entities-in-middle-east-and-south-asia","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/dont-expect-any-howls-goldenjackal-cyber-gang-spying-on-diplomatic-entities-in-middle-east-and-south-asia\/","title":{"rendered":"Don\u2019t expect any howls: GoldenJackal cyber gang spying on diplomatic entities in Middle East and South Asia"},"content":{"rendered":"\n

Kaspersky discovered a new cybercriminal group. Dubbed GoldenJackal, it has been active since 2019, but has had no <\/strong>public profile and has remained largely unknown.<\/strong> As the investigation shows, the group usually targets <\/strong>government and diplomatic entities in the Middle East and South Asia. <\/strong><\/p>\n\n\n\n

Kaspersky began monitoring the group in mid-2020 and observed a consistent flow of activities, which portray a capable and moderately stealthy actor. The main feature of this group is a specific toolset intended to control the machines of their victims, spread across systems using removable drives, and smuggle certain files from them, suggesting that the actor\u2019s primary goal is espionage.<\/p>\n\n\n\n

As Kaspersky\u2019s investigation shows, the actor used fake Skype installers and malicious Word documents as initial vectors for their attacks. The fake Skype installer was an executable file that was approximately 400 MB in size. It was a dropper containing two resources: the JackalControl Trojan and a legitimate Skype for business standalone installer. The first usage of this tool was tracked back to 2020. Another infection vector was a malicious document that uses the remote template injection technique to download a malicious HTML page, which exploits\u00a0the Follina vulnerability.<\/a><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

The first page of the malicious document<\/em><\/p>\n\n\n\n

The document was named \u201cGallery of Officers Who Have Received National and Foreign Awards.docx\u201d and appears as a legitimate circular requesting the information about officers decorated by Pakistan\u2019s government. The first description of the Follina vulnerability was published on May 29, 2022 and this document appears to have been modified on June 1, two days after the publication, and was first detected on June 2.<\/p>\n\n\n\n

The document was configured to load an external object from a legitimate and compromised website. Once the external object is downloaded, the executable file is launched, which contains the JackalControl Trojan malware. <\/p>\n\n\n\n

JackalControl is the main trojan and it allows the attackers to control the target machine remotely through a set of predefined and supported commands. Over the years the attackers have distributed different variants of this malware: some include code to maintain persistence, others were configured to run without infecting the system. The machine usually gets infected by other components, such as a batch script.<\/p>\n\n\n\n

The second important tool usually deployed by the GoldenJackal group is a JackalSteal. This tool can be used to monitor removable USB drives, remote shares, and all logical drives in the targeted system. The malware can work as a standard process or as a service. It cannot maintain persistence, so it must be installed by another component. <\/p>\n\n\n\n

Finally, GoldenJackal uses a number of additional tools, such as JackalWorm, JackalPerInfo and JackalScreenWatcher. They are deployed in specific cases that were witnessed by Kaspersky researchers. This toolset is aimed at controlling victims\u2019 machines, stealing their credentials, taking screen shots of the desktop and so on \u2013 with espionage as an ultimate objective.<\/p>\n\n\n\n

\u201c<\/em>GoldenJackal is an interesting APT actor that tries to keep a low profile \u2013 despite first kicking off its operation back in June 2019, it managed to stay under the radar. Possessing an advanced malware toolset, it has been quite prolific in its attacks on government and diplomatic entities in the Middle East and Southern Asia. Since some of the malware implants are still in the developing stages, it is crucial for cybersecurity teams to watch out for any possible attacks that might be performed by the actor. We hope that our analysis will help prevent GoldenJackal\u2019s activity,\u201d<\/em> comments Giampaolo Dedola, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

Read the full report about the GoldenJackal APT group\u00a0on Securelist<\/a>.<\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n