Kaspersky, a cybersecurity solutions company, have uncovered a advanced persistent threat (APT) campaign that targets government entities in the Asia-Pacific region (APAC). The campaign called “TetrisPhantom” compromises a secure USB drive used to provide encryption for safe data storage. 

“These operations were conducted by a highly skilled and resourceful threat actor, with a keen interest in espionage activities within sensitive and safeguarded government networks,” said Noushin Shabab, senior security researcher at Kaspersky’s Global Research and Analysis Team (GReAT).

The TetrisPhantom campaign is composed of different malicious modules, through which the actor can gain extensive control over the victim’s device. This allows them to execute commands, collect files and information from compromised machines, and transfer them to other machines using the same or different secure USB drives as carriers. 

Kaspersky identifies phishing websites offering fake WormGPT tool
Kaspersky: AI can augment IT security teams’ tasks

Early this year, Kaspersky uncovered a long-running espionage campaign operated by a previously unknown actor. The attacker covertly spied on and harvested sensitive data from APAC government entities by exploiting a particular type of secure USB drive, protected by hardware encryption to ensure the secure storage and transfer of data between computer systems. These secure USB drives are employed by government organizations worldwide, implying that more entities might potentially fall prey to similar techniques.

More sophisticated attacks

Kaspersky researchers report there are a limited number of victims, highlighting the highly targeted nature of the attack.

Kaspersky researchers have not observed any overlaps with any existing threat actor, but with this attack campaign still ongoing, experts continue to track its progress and expect to see more sophisticated attacks from them in the future.

To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:

• Regularly update your operating system, applications, and antivirus software to patch any known vulnerabilities.
• Be cautious of emails, messages, or calls asking for sensitive information. Verify the sender’s identity before sharing any personal details or clicking at suspicious links.
• Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single point of access for the company’s TI, providing cyberattack data and insights gathered by Kaspersky spanning over 20 years.
•  Upskill your cybersecurity team to tackle the latest targeted threats with Kaspersky online training developed by GReAT experts
• For endpoint level detection, investigation, and timely remediation of incidents, implement EDR solutions such as Kaspersky Endpoint Detection and Response.