Confucius
Confucius is a threat actor tracked in the provided content under the aliases Confucius and confucius_apt. The content attributes to Confucius spearphishing-based initial access using crafted malicious attachments, including lures tied to current topics, to induce victim execution. Observed execution tradecraft includes PowerShell. For persistence, Confucius has dropped malicious files into the Windows Startup folder at %AppData%\Microsoft\Windows\Start Menu\Programs\Startup and has also created scheduled tasks on compromised hosts. For collection, Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders and steals documents and images with extensions including txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg. For command and control, Confucius has used HTTP communications. For exfiltration, the content states that Confucius exfiltrated stolen files to its C2 server and also exfiltrated victim data to cloud storage service accounts.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
38 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
APT41 leveraged the follow exploits... CVE-2015-1641...
...has exploited Office vulnerabilities such as CVE-2017-11882...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Zscaler's ThreatLabz named the APT28 campaign exploiting it "Operation Neusploit." Trellix published a detailed analysis. CISA added it to the Known Exploited Vulnerabilities catalog... An India-linked threat actor is using CVE-2026-21509 weaponized documents to target Pakistani government entities... The attack follows the same CVE-2017-0199 → CVE-2017-11882 pattern documented in APT28's Operation Neusploit... Weaponized DOCX ... → CVE-2026-21509: Remote template injection
Observables
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Associated with exfiltration to cloud storage, specifically the use of Azure Storage utilities such as AzCopy or Storage Explorer for staging or extracting sensitive data over trusted cloud channels.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.