#hellsingapt

This group targets government and diplomatic organizations in the APAC region, particularly organizations located in nations along the South China Sea. Most targets are from Malaysia, the Philippines, Indonesia, and India. Hellsing malware samples were primarily compiled in either UTC+6 or UTC+8. Typically, it infects targets through spear phishing emails containing password protected RAR, ZIP, and 7ZIP archives. The passwords are sent in the emails to the target. Locking the archives bypasses some security features such as Gmail scans.  Hellsing APT was discovered when Kaspersky Lab was investigating the Naikon group and found that Hellsing had responded to a 2014 spear phishing email from Naikon with a custom backdoor. It is not clear whether Naikon intentionally targeted Hellsing or if Hellsing actually managed to infect Naikon; however, it is clear that Hellsing took the attempt as an attack and responded with an escalated attack. Hellsing responded to the spear phishing request for information with a series of inquisitive exchanges, pressing Naikon’s assumed identity (as an employee of the secretariat division of the government of the assumed target nation) and fake credentials. The conversation demonstrates that the Hellsing members are more proficient in English than the Naikon group. Finally, Hellsing emailed back a “confidential” locked RAR and the accompanying password. The archive contained two PDFs and a malicious SCR file. The latter file was a backdoor specifically customized to target the Naikon group.

This group targets government and diplomatic organizations in the APAC region, particularly organizations located in nations along the South China Sea. Most targets are from Malaysia, the Philippines, Indonesia, and India. Hellsing malware samples were primarily compiled in either UTC+6 or UTC+8. Typically, it infects targets through spear phishing emails containing password protected RAR, ZIP, and 7ZIP archives. The passwords are sent in the emails to the target. Locking the archives bypasses some security features such as Gmail scans.  Hellsing APT was discovered when Kaspersky Lab was investigating the Naikon group and found that Hellsing had responded to a 2014 spear phishing email from Naikon with a custom backdoor. It is not clear whether Naikon intentionally targeted Hellsing or if Hellsing actually managed to infect Naikon; however, it is clear that Hellsing took the attempt as an attack and responded with an escalated attack. Hellsing responded to the spear phishing request for information with a series of inquisitive exchanges, pressing Naikon’s assumed identity (as an employee of the secretariat division of the government of the assumed target nation) and fake credentials. The conversation demonstrates that the Hellsing members are more proficient in English than the Naikon group. Finally, Hellsing emailed back a “confidential” locked RAR and the accompanying password. The archive contained two PDFs and a malicious SCR file. The latter file was a backdoor specifically customized to target the Naikon group.

Hellsing (other names associated are Goblin Panda and Cycldek) target Sectors: government and diplomatic organizations in nations near the South China Sea; Aerospace, Defense, Energy, Government, Shipping, Technology. Last reported activity was October 2013.