Fishing Elephant

Executive Summary

Fishing Elephant is a persistent threat actor targeting South Asian regions, notably Bangladesh and Pakistan, with recent shifts towards government entities in Turkey, Ukraine, China, and others. Utilizing AresRAT delivered via platforms like Heroku and Dropbox, they employ advanced techniques such as geo-fencing and hiding executables within certificate files, indicating a capability to adapt their attack methods.

Goals & Targeting

Fishing Elephant's strategic objectives appear to focus on gaining access to sensitive data or causing disruption within targeted nations. Their geographic shifts suggest a potential interest in espionage or diplomatic communications, targeting regions with significant geopolitical interests.

Fishing Elephant operates with a focus on South Asian regions, initially targeting Bangladesh and Pakistan. Their operations exhibit consistent TTPs, including payload delivery through Heroku and Dropbox, alongside the use of AresRAT. Notably, they have incorporated advanced techniques such as geo-fencing to evade detection and hide executables within certificate files. Recently, their targets have expanded to include government and diplomatic entities in Turkey, Pakistan, Bangladesh, Ukraine, and China. This shift suggests an evolving strategy aimed at accessing sensitive information or disrupting critical operations.

Key Capabilities

• Use of AresRAT for remote control and persistence
• Consistent TTPs with occasional technique updates
• Geo-fencing for regional targeting
• Payload delivery via legitimate platforms like Heroku and Dropbox

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Fishing Elephant maintains a steady operational tempo, with campaigns persisting across targeted regions. Their recent shift towards government entities indicates a focus on high-value targets for potential intelligence gathering or disruption.

IOC Patterns

• Use of Heroku and Dropbox for payload delivery
• Hiding executables within certificate files

Recommended Actions

• Monitor network traffic for C2 communications
• Conduct regular user training to recognize phishing attempts
• Secure RDP access with strong authentication measures

Suggested Tags