Executive Summary

BGD e-GOV CIRT is issuing this cybersecurity advisory regarding an active and highly targeted cyber-espionage campaign directed against Bangladesh military and defence personnel.

The campaign has been attributed with high confidence by security researchers to DoNot Team (APT-C-35), an advanced persistent threat group known for conducting sustained intelligence-gathering operations against government, military, diplomatic, and strategic organizations across South Asia.

The observed intrusion begins with a carefully crafted spear-phishing lure named:

Biography Air Vice Marshal Sitwat Nayeem.doc

The document is designed to appear as biographical information concerning a senior Bangladesh Air Force officer, demonstrating deliberate targeting of Bangladesh’s defence community.

The malicious RTF does not directly contain the principal malware payload. Instead, it uses remote template injection to contact attacker-controlled infrastructure and retrieve a malicious Microsoft Word template. Importantly, the delivery infrastructure performs server-side victim filtering/geofencing, allowing the threat actor to selectively deliver malicious content to intended targets while presenting benign content to researchers, sandboxes, VPN users, or other non-target systems.

Once the malicious template is delivered, embedded VBA code executes architecture-specific shellcode and abuses Windows APIs to execute code inside the Microsoft Office process. Subsequent stages use multiple layers of XOR encoding, runtime API resolution, anti-hooking techniques, and payload masquerading using benign-looking .ico, .mp3, and .doc extensions.

The infection ultimately deploys a DLL implant that:

· establishes scheduled-task persistence disguised as Microsoft OneDrive telemetry;

· collects detailed host and software information;

· communicates with attacker-controlled infrastructure over HTTPS;

· encrypts reconnaissance data using AES-128-CBC;

· implements a multi-phase C2 handshake;

· conditionally downloads additional modules based on victim profiling; and

· deletes original artifacts to reduce forensic evidence.

Researchers were able to retrieve a live follow-on module, ejtest.dll, directly from active C2 infrastructure, indicating that the infrastructure was actively capable of delivering additional payloads at the time of investigation.

Given the highly targeted lure, regional filtering, active C2 infrastructure, modular payload delivery and focus on military personnel, BGD e-GOV CIRT assesses this activity as presenting a critical cyber-espionage risk to Bangladesh’s defence and government ecosystem.

Bangladesh-Specific Threat Assessment

This campaign should be treated as particularly significant because the observed intrusion is not a generic malware distribution campaign.

The lure itself was customized around Bangladesh’s military environment. The malicious document used the biography of a Bangladesh Air Force officer as the social-engineering theme, indicating prior reconnaissance and knowledge of the intended target community.

Furthermore, the malicious template infrastructure reportedly evaluates characteristics of incoming requests before deciding whether to deliver malicious content. Researchers observed that direct requests could receive a benign template instead of the malicious VBA-enabled version.

This selective-delivery architecture can significantly reduce detection by automated malware-analysis platforms. Potentially at-risk entities include:

· Bangladesh Armed Forces;

· Ministry of Defence and related organizations;

· defence contractors and suppliers;

· diplomatic missions;

· strategic government organizations;

· military research and educational institutions;

· personnel communicating with defence establishments; and

· organizations maintaining trusted relationships with defence networks.

Compromise of such systems may enable intelligence collection relating to military personnel, internal documents, organizational structures, installed software, operational communications and other sensitive information.

Technical Attack Chain

Initial Access – Targeted RTF Spear-Phishing

The observed initial-access artifact was:

Biography Air Vice Marshal Sitwat Nayeem.doc

Despite the .doc extension, the file is a weaponized RTF document. The lure presents a fake Microsoft Office Protected View-style message instructing the recipient to enable editing and active content. This social-engineering mechanism attempts to convince the target that normal Microsoft Office security controls are preventing legitimate content from being displayed.

The use of military-specific information is important from a threat-intelligence perspective because it suggests deliberate target selection rather than mass phishing.

Remote Template Injection

The RTF does not directly embed the main malicious VBA payload. Instead, it contains an external template reference. Analysis of the RTF template destination reveals an obfuscated remote URL using Unicode escape sequences.

The decoded infrastructure included:

hxxp[://]greezupdto[.]info/5IrzalAfHEUM9Tg6/5zbnrP5Dj2BLtwQm[.]php

Microsoft Word attempts to retrieve the external template when the document is opened.

Encoding the URL using Unicode escape sequences helps conceal the network indicator from basic static analysis and security controls searching documents for plaintext URLs.

Get the full Advisory in PDF below