Danti

Danti is an advanced persistent threat (APT) group, related to NetTraveller and DragonOK, known for targeting Indian government organizations and embassies, as well as entities in Kazakhstan, Kyrgyzstan, Uzbekistan, Myanmar, Nepal, and the Philippines. Danti's campaigns in early 2016 leveraged spear-phishing emails containing malicious DOCX attachments exploiting CVE-2015-2545, a Microsoft Office vulnerability allowing remote code execution via embedded EPS files. The group used custom shellcode to drop backdoors and other payloads, including keyloggers and data exfiltration tools. Danti demonstrated the ability to modify exploits to evade antivirus detection and used multi-stage payloads, privilege escalation, and extensive system reconnaissance. Their infrastructure included C2 domains such as newsupdate.dynssl.com and dnsnews.dns05.com, often using dynamic DNS services and hosting in Asia. The attacks were highly targeted, focused on government and diplomatic sectors, and involved decoy documents relevant to the victims. Indicators of compromise include specific hashes, C2 domains, and email addresses associated with the campaigns.