HackBrowserData Infostealer Malware Uses in Attacks on Indian Entities

Researchers have exposed a fresh espionage attempt directed at Indian governmental bodies and the nation's energy sector, employing a modified edition of an open-source data pilfering tool named HackBrowserData. This tool is capable of gathering login credentials, cookies, and browsing history.

Unveiled by researchers from Dutch cybersecurity firm EclecticIQ in early March, the campaign's origin remains unidentified. Their findings, disclosed on Wednesday, reveal that hackers siphoned off 8.81 GB of data from targets, potentially facilitating further infiltrations into Indian government systems.

Initial Attact Vector Uses PDF Files

The malicious software was distributed through a phishing PDF file masquerading as an invitation letter from the Indian Air Force. It's presumed that the original PDF was obtained in a prior breach and repurposed by the attackers.

The innocuous-looking document contained a hidden shortcut to the malware. Once activated, the malware promptly commenced stealing documents and cached browser data, transmitting them to Slack channels under the control of the attackers, aptly named "FlightNight."

HackBrowserData Goes After Documents and Databases

The malware was programmed to specifically target certain file types, such as Microsoft Office documents, PDFs, and SQL databases, likely to expedite the theft process.

Victimized entities included Indian agencies overseeing electronic communications, IT governance, and national defense, as well as private energy firms, from which financial documents, employee details, and information on oil and gas drilling activities were extracted.

Though the group responsible for the campaign remains unidentified, the similarities in the malware and delivery method suggest a link to a previous attack in January, which targeted Indian Air Force officials using a credential-stealing malware named GoStealer.

Both campaigns appear to be the handiwork of the same threat actor, as per EclecticIQ. These incidents underscore the effectiveness of leveraging open-source tools for cyber espionage, according to the researchers.