ORPCBackdoor

ORPCBackdoor is a custom backdoor that uses the RPC protocol to communicate with its command-and-control (C2) server and execute operator-issued instructions. Reporting cited in the source material links the malware to multiple South Asian espionage clusters: it has been used by Bitter (TA397), Mysterious Elephant (APT-K-47), and Confucius. Researchers specifically noted that all three groups have used ORPCBackdoor, suggesting either a shared malware arsenal or coordination through a common development entity. Knownsec 404 Team attributed ORPCBackdoor to Mysterious Elephant and described tooling overlap involving SideWinder, Patchwork, Confucius, and Bitter. The surrounding reporting places this malware in campaigns associated with government, diplomatic, and defense targeting, including activity aligned with Indian state interests in Bitter-related investigations, while separate Knownsec reporting lists ORPCBackdoor as part of Mysterious Elephant’s broader toolkit used in operations primarily targeting Pakistani victims, with additional targeting of Bangladesh and Turkey. No specific indicators of compromise for ORPCBackdoor are provided in the content.