Charged by an Elephant - An APT Fabricating Evidence to Throw You In Jail

Overview: SentinelLabs researchers Tom Hegel and Juan Andres Guerrero-Saade ("Jax") present an investigation into "ModifiedElephant," a state-aligned advanced persistent threat (APT) active for over a decade. The researchers examine how this threat actor weaponized malware not merely for intelligence collection, but to plant fabricated, incriminating evidence on the computing devices of human rights activists, lawyers, and journalists in India. Integrating threat intelligence telemetry with digital forensic findings from Arsenal Consulting, the talk exposes the severe human cost of unregulated offensive cyber operations and digital entrapment.

Key Topics: - Threat actor profiling of the decade-long ModifiedElephant APT campaign - Digital entrapment and evidence fabrication in the Bhima Koregaon 16 (BK-16) case - Digital forensics methodology and collaboration with Arsenal Consulting - Evolution of attack vectors: from simple executable attachments to weaponized Office exploit documents - Netwire RAT deployment and remote forensic evidence of file planting

Technical Details: The research was initiated following forensic investigations by Arsenal Consulting into the framing of Turkish journalist Baris Pehlivan, which identified an actor designated "Egomaniac" with operational ties to Turkish law enforcement and Hacking Team leaks. Arsenal subsequently alerted SentinelLabs to parallel evidence-tampering activity in India surrounding the "BK-16" (Bhima Koregaon) activists, who were imprisoned on severe terrorism charges based on electronic files recovered from their laptops. SentinelLabs analyzed malware samples, historical infrastructure, and command-and-control (C2) servers, establishing a continuous 10-year campaign attributable to ModifiedElephant.

Despite achieving catastrophic real-world outcomes, ModifiedElephant operated with remarkably low technical sophistication. Their initial access tradecraft evolved gradually across a ten-year timeline: starting in 2013 with crude spear-phishing emails containing direct executable attachments, transitioning to double extensions (.doc.exe), and eventually incorporating weaponized Microsoft Office documents exploiting known vulnerabilities to deploy commodity remote access trojans, primarily Netwire RAT.

The digital forensic analysis performed by Arsenal Consulting provided irrefutable proof of digital entrapment rather than user complicity. Forensic timeline reconstruction revealed that incriminating letters and documents were planted directly during active Netwire RAT sessions controlled by the threat actor. The operators remotely deposited fabricated documents into hidden volume paths that the legitimate users had never navigated. Forensic examination of document metadata confirmed that the planted files were created using versions of Microsoft Word never present on the victims' machines, and local filesystem logs showed the documents had never once been opened or viewed by the device owners prior to their forensic seizure.

Key Takeaways: Offensive surveillance tooling and commodity malware are increasingly deployed by unscrupulous actors to manufacture digital evidence and facilitate unlawful imprisonment. Digital forensics investigations must not rely solely on the static presence of incriminating files; investigators must scrutinize filesystem timestamps, software version provenance, and concurrent RAT connection logs to distinguish legitimate user activity from planted evidence. Organizations defending civil society must implement strict email filtering and endpoint monitoring to detect commodity malware payloads that exploit low-sophistication vectors.

(AI summary — Gemini Flash)