NexusRoute: Attempting to Disrupt an Indian Government Ministry – CYFIRMA

MITRE Techniques

• [T1476 ] Deliver Malicious App – Fake mParivahan APK delivered via GitHub Pages and phishing domains to install the trojanized app (‘Fake mParivahan APK delivered via GitHub Pages and phishing domains instead of official app stores.’)
• [T1566 ] Phishing – Cloned challan and payment portals impersonating government services to harvest credentials (‘Victims lured using cloned challan and payment portals impersonating government services.’)
• [T1204 ] User Execution – Requires users to enable “Install from Unknown Sources” and manually install the APK (‘Users manually install the malicious APK after enabling “Install from Unknown Sources.”’)
• [T1626 ] Dynamic Code Loading – Uses DexClassLoader and native libraries to load payloads at runtime, hiding functionality until execution (‘DexClassLoader and native libraries used to load malicious payloads at runtime.’)
• [T1624 ] Event Triggered Execution – Malware executes in response to system events to maintain activity (‘Malware executes automatically in response to system events.’)
• [T1624.001 ] Broadcast Receivers – Abuse of Android broadcast receivers to maintain background execution and persistence (‘Abuse of Android broadcast receivers to maintain background execution.’)
• [T1541 ] Foreground Persistence – Keeps a continuous foreground service disguised as legitimate to avoid termination (‘Malware maintains a continuous foreground service disguised as a legitimate app.’)
• [T1603 ] Scheduled Task/Job – Uses scheduled background jobs to ensure repeated execution of malicious components (‘Scheduled background jobs ensure repeated execution of malicious components.’)
• [T1409 ] Access Sensitive Data – Requests excessive permissions to read SMS, contacts, storage, and phone state for credential theft and profiling (‘Abuse of SMS, contacts, phone state, and storage permissions to escalate access.’)
• [T1407 ] Download New Code at Runtime – Fetches and installs secondary APKs and updated payloads from external storage and remote hosts (‘Additional payloads fetched dynamically after initial installation.’)
• [T1627 ] Obfuscated Files or Information – Heavy string and code obfuscation (NP Manager) used to hinder reverse engineering (‘Heavy string and code obfuscation used to evade detection and analysis.’)
• [T1629 ] Impair Defenses – Forces dangerous permission grants, disables protections, and uses deceptive prompts to weaken device defenses (‘Malware forces dangerous permission grants and weakens system protections.’)
• [T1629.001 ] Prevent Application Removal – Uses fake security alerts and persistent prompts to discourage uninstall attempts and remove only the dropper (‘Fake security warnings and persistent prompts discourage uninstall attempts.’)
• [T1417 ] Input Capture – Phishing forms and overlays capture OTPs, UPI PINs, and payment data (‘Reuse of phishing forms and overlays to collect OTPs and authentication values.’)
• [T1417.002 ] GUI Input Capture – Visual UPI PIN keypad and payment entry screens harvest sensitive inputs (‘Visual UPI PIN and payment entry screens used to harvest sensitive inputs.’)
• [T1417.001 ] Keylogging – Keystroke-level monitoring and local log staging used to capture credentials (‘User keystrokes collected during authentication interactions.’)
• [T1513 ] Screen Capture – MediaProjection-based screen capture activated via C2 commands to observe victim screens (‘Screen contents related to verification and payment screens captured for fraud.’)
• [T1071 ] Application Layer Protocol – Uses HTTP/WebSocket (Socket.IO) channels for C2 and real-time operator interaction (‘Persistent WebSocket-based channels with automatic reconnection, enabling real-time operator interaction.’)
• [T1020 ] Automated Exfiltration – Stolen SMS, SIM data, credentials and device info are automatically exfiltrated to central C2 (‘Stolen SMS, SIM data, credentials, and device information exfiltrated automatically.’)
• [T1471 ] Data Encrypted for Impact – Potential capability noted to encrypt local data for disruption or extortion (‘Potential capability to encrypt local data for disruption or extortion.’)
• [T1516 ] Input Injection – Malware can simulate or inject user input (via Accessibility) to manipulate victim interactions and automate transactions (‘Simulated or injected user input used to manipulate victim interactions.’)