Loading malware…
Vtyrei is a downloader malware observed in early intrusion chains attributed by Kaspersky to the Mysterious Elephant APT, and previously connected to Origami Elephant. Kaspersky reported that early Mysterious Elephant activity resembled Confucius tradecraft and included remote template injection and exploitation of CVE-2017-11882, followed by use of Vtyrei as a downloader. The malware is associated with espionage-focused operations targeting government entities and foreign affairs organizations in the Asia-Pacific region, with particular focus on South Asia including Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka. High-confidence details in the provided content identify Vtyrei specifically as a downloader used in these campaigns; no additional technical capabilities, infection mechanics beyond its role in the early attack chain, or standalone indicators of compromise are directly provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Downloader used in earlier Mysterious Elephant attack chains to fetch/execute subsequent payloads; historically associated with Origami Elephant and later reused/maintained by Mysterious Elephant.
Downloader used to deploy RTY (as described).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.