- Fintech users in Pakistan and other countries are under cyber attacks.
- DeathStalker hacker group linked to global cyber attack targeting fintech and trading sectors, including Pakistan.
- Attackers use Telegram to distribute Trojan spyware, specifically DarkMe malware, designed to steal sensitive data.
The DeathStalker group, active since at least 2012, typically targets small and medium-sized enterprises (SMEs), financial institutions, law firms, and occasionally government bodies. The group’s operations are believed to be more about gathering intelligence rather than financial theft, as they have never been observed stealing funds.
The malware is delivered through Telegram channels, often in the form of seemingly harmless archives. These files, once opened by victims, deploy DarkMe, a remote access Trojan capable of stealing information and executing remote commands. After the malware is installed, it removes traces of its deployment and increases the file size to evade detection, making analysis more difficult for security professionals.
Kaspersky’s lead security researcher, Maher Yamout, advised users to be cautious of suspicious emails and links, "Threat actors relied on Telegram channels to deliver the malware. In earlier campaigns, we also observed this operation using other messaging platforms, such as Skype, as a vector for initial infection. This method may make potential victims more inclined to trust the sender and open the malicious file".
DeathStalker’s tactics include using false flags to avoid being linked to their activities, often mimicking other advanced persistent threat (APT) groups. Kaspersky urges organizations to enhance their cybersecurity defenses and keep informed about the growing risks in their sectors.
[embedpost slug="/pta-declares-safety-of-electronic-devices-not-its-responsibility/"]
