MONSOON – ANALYSIS OF AN APT CAMPAIGN

Forcepoint Security Labs | Special Investigations
ATTRIBUTION
With respect to attribution, Forcepoint Security Labs focus on enabling the awareness and
understanding of intent. This is useful in order to identify likely future behaviour. Reports from
Special Investigations do not focus on specific attribution.
VICTIMS
The MONSOON victims fit with a group who have military and political interests in the Indian
Subcontinent. Many of the victims are located in surrounding countries including Bangladesh, Sri
Lanka and Pakistan. But victims also originate from further afield, including Africa and the Far East.
The targeting of Chinese nationals may also be related to this campaign, but equally may be part of
a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in
a similar manner previously seen with the HANGOVER group [2].
ADVERSARIES
It was possible to identify an individual from a domain registration record who is believed to be
associated with MONSOON. There is a highly probable level of confidence in this association due to
the following reasons:
The domain name registered is a variant of one of the most popular domains used in
MONSOON
The person who registered the domain lives or has lived and works in India
The person who registered the domain has profiles on coding challenge and freelance coder
websites. The HANGOVER group are thought to use freelance coders.
From the information available, it was possible to identify this individual’s Facebook and LinkedIn
accounts. However, it is not deemed in the public interest to publish specific details on this
individual. Relevant authorities are informed as and when appropriate.
Cui Bono? A useful analysis viewpoint is to ask the legal question: Cui Bono? Or: “who profits?”
Even though this report does not attempt to focus on specific attribution, asking “What is to be
gained from these actions or what needs are satisfied?” may offers some insight. Any further
analysis is left as an exercise to for reader.
From the documents known to have been exfiltrated, a number of recurring themes occur:
Army training, personnel and payroll
records
Defence attaches and consulates
Defence research
Foreign high commissions
Military exercises
Military air platforms
Military naval platforms
Military logistic records
Naval coastal protection
Anti-torpedo and naval electronic
countermeasure (ECM) systems.
Submarine communication systems
Nuclear security and counter
proliferation
United Nations
Personal details including medical
records, driving license, passport and
visas
Accounting records
Travel and itinerary details
MONSOON – ANALYSIS OF AN APT CAMPAIGN Revision: 1.07 | TLP-WHITE | 47/57