Loading story…
The advanced persistent threat (APT) group known as Confucius has intensified its cyber-espionage operations against Pakistani targets by evolving its malware arsenal and attack techniques. Confucius, active since 2013 and believed to be linked to India-sponsored cyber operations, has historically targeted government agencies, military organizations, defense contractors, and critical industries in Pakistan. Recent research by FortiGuard Labs reveals a significant shift in the group’s tactics, moving from the use of infostealers to more sophisticated Python-based backdoors. The group’s latest campaigns have leveraged spear-phishing emails and malicious documents as initial access vectors, a hallmark of their operations over the past decade. In December 2024, Confucius used a phishing campaign that delivered WooperStealer via a malicious .PPSX file, utilizing DLL side-loading techniques to compromise Windows-based systems. This was followed by another wave in March 2025, where Windows shortcut (.LNK) files were used to sideload the WooperStealer DLL, enabling the theft of sensitive data from infected hosts. By August 2025, the group had further refined its approach, using .LNK files to sideload a rogue DLL that deployed Anondoor, a Python-based implant. Anondoor is capable of exfiltrating device information, executing commands, taking screenshots, enumerating files and directories, and dumping passwords from Google Chrome, providing the attackers with persistent surveillance capabilities. The use of Anondoor was first documented by Seebug's KnownSec 404 Team in July 2025, highlighting the group’s ongoing innovation. Confucius has demonstrated strong adaptability by layering obfuscation techniques to evade detection and tailoring its toolset to shifting intelligence-gathering priorities. The group’s campaigns illustrate a clear evolution from short-term data theft to long-term monitoring and persistence within targeted networks. Researchers warn that this shift represents a significant increase in the group’s technical sophistication and operational objectives. The attacks underscore the persistent threat posed by state-sponsored actors in the South Asian region, particularly as they continue to refine their methods to bypass security controls. The campaigns have primarily targeted Microsoft Windows environments, exploiting common user behaviors such as opening email attachments and shortcut files. The group’s ability to rapidly adapt its malware and delivery mechanisms poses ongoing challenges for defenders. Security experts recommend heightened vigilance, user education, and robust endpoint protection to mitigate the risks associated with such advanced threats. The continued targeting of critical sectors in Pakistan by Confucius highlights the geopolitical motivations driving these cyber-espionage activities. Organizations in the region are urged to monitor for indicators of compromise related to WooperStealer and Anondoor and to implement layered security measures to detect and respond to such threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On October 2, 2025, FortiGuard Labs publicly disclosed that Confucius had evolved from using WooperStealer to deploying the more capable AnonDoor backdoor in Pakistan-focused espionage operations. The report highlighted the group's adaptability, obfuscation changes, and released indicators of compromise to help defenders detect related activity.
Analysis of the August 2025 AnonDoor variant showed it could fingerprint hosts, execute commands, capture screenshots, enumerate and exfiltrate files, and steal Chrome passwords, with one version resembling an MSIL-based implant. Researchers also noted a distinctive data-formatting scheme before exfiltration and command-and-control infrastructure that appeared geographically restricted, including to Pakistan.
In August 2025, Fortinet observed a notable escalation in which Confucius replaced its prior infostealer-focused approach with the Python-based backdoor AnonDoor on Windows targets in Pakistan. The intrusion used PowerShell to install Scoop, prepared the environment for Python execution, and established persistence with a scheduled task running pythonw.exe and a downloaded .pyc file.
Over the course of the observed campaigns, Confucius changed its delivery tactics from PowerPoint lure documents to phishing emails carrying LNK attachments disguised as files such as PDFs. The group continued to rely on DLL sideloading, including abuse of a renamed fixmapi.exe, to execute malicious payloads.
Fortinet reported that Confucius was still deploying the WooperStealer infostealer in campaigns seen as recently as March 2025. The activity continued to target Pakistani government, military, defense, and critical-sector entities.
Fortinet observed Confucius launching phishing campaigns targeting organizations in Pakistan beginning in December 2024. Early waves used lure documents such as PowerPoint files and delivered the WooperStealer infostealer through multi-stage chains involving scripts, LNK files, PowerShell, and DLL sideloading.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026
Mysterious Elephant, an advanced persistent threat (APT) group first identified in 2023, has intensified its cyber-espionage activities targeting government and diplomatic entities in the Asia-Pacific region, with a particular focus on South Asia. The group’s latest campaign, which began in early 2025, demonstrates a significant evolution in their tactics, techniques, and procedures (TTPs). Mysterious Elephant has deployed a new custom backdoor known as MemLoader, alongside other tools such as BabShell and customized open-source utilities, to infiltrate targeted networks. The campaign is notable for its focus on exfiltrating sensitive WhatsApp data, including documents, images, and archive files, from compromised systems. Spear phishing remains a primary initial access vector, with malicious attachments and links used to deliver the malware payloads. Once inside a network, the attackers leverage PowerShell scripts and other living-off-the-land techniques to maintain persistence and evade detection. The group’s malware exhibits code similarities with other APTs, such as Origami Elephant, Confucius, and SideWinder, indicating possible collaboration or shared development resources. Victimology analysis shows a clear targeting of foreign affairs ministries, embassies, and diplomatic missions, particularly those involved in sensitive regional matters. The attackers have also demonstrated the ability to customize their tools for specific environments, increasing the effectiveness of their operations. Infrastructure used in the campaign includes a mix of compromised servers and dedicated command-and-control domains, with indicators of compromise (IOCs) provided to aid in detection. The campaign’s focus on WhatsApp data theft is particularly concerning, as it highlights the attackers’ intent to access private diplomatic communications. Defensive measures recommended include monitoring for the specific IOCs, enhancing email security to block spear phishing attempts, and deploying endpoint detection and response (EDR) solutions capable of identifying the custom tools used. The campaign underscores the growing sophistication of APT operations in the region and the need for heightened vigilance among government and diplomatic organizations. The use of both custom and open-source tools allows Mysterious Elephant to adapt quickly and bypass traditional security controls. The group’s activities are part of a broader trend of state-sponsored cyber-espionage targeting geopolitical interests in South Asia. Organizations are urged to review their security postures and implement layered defenses to mitigate the risk posed by such advanced threats. The ongoing evolution of Mysterious Elephant’s toolset suggests that future campaigns may employ even more sophisticated techniques. Collaboration between targeted organizations and threat intelligence providers is essential to stay ahead of these evolving threats. The campaign serves as a reminder of the persistent and adaptive nature of APT actors operating in the region.
Jun 29, 2026