Loading story…
Mysterious Elephant, an advanced persistent threat (APT) group first identified in 2023, has intensified its cyber-espionage activities targeting government and diplomatic entities in the Asia-Pacific region, with a particular focus on South Asia. The group’s latest campaign, which began in early 2025, demonstrates a significant evolution in their tactics, techniques, and procedures (TTPs). Mysterious Elephant has deployed a new custom backdoor known as MemLoader, alongside other tools such as BabShell and customized open-source utilities, to infiltrate targeted networks. The campaign is notable for its focus on exfiltrating sensitive WhatsApp data, including documents, images, and archive files, from compromised systems. Spear phishing remains a primary initial access vector, with malicious attachments and links used to deliver the malware payloads. Once inside a network, the attackers leverage PowerShell scripts and other living-off-the-land techniques to maintain persistence and evade detection. The group’s malware exhibits code similarities with other APTs, such as Origami Elephant, Confucius, and SideWinder, indicating possible collaboration or shared development resources. Victimology analysis shows a clear targeting of foreign affairs ministries, embassies, and diplomatic missions, particularly those involved in sensitive regional matters. The attackers have also demonstrated the ability to customize their tools for specific environments, increasing the effectiveness of their operations. Infrastructure used in the campaign includes a mix of compromised servers and dedicated command-and-control domains, with indicators of compromise (IOCs) provided to aid in detection. The campaign’s focus on WhatsApp data theft is particularly concerning, as it highlights the attackers’ intent to access private diplomatic communications. Defensive measures recommended include monitoring for the specific IOCs, enhancing email security to block spear phishing attempts, and deploying endpoint detection and response (EDR) solutions capable of identifying the custom tools used. The campaign underscores the growing sophistication of APT operations in the region and the need for heightened vigilance among government and diplomatic organizations. The use of both custom and open-source tools allows Mysterious Elephant to adapt quickly and bypass traditional security controls. The group’s activities are part of a broader trend of state-sponsored cyber-espionage targeting geopolitical interests in South Asia. Organizations are urged to review their security postures and implement layered defenses to mitigate the risk posed by such advanced threats. The ongoing evolution of Mysterious Elephant’s toolset suggests that future campaigns may employ even more sophisticated techniques. Collaboration between targeted organizations and threat intelligence providers is essential to stay ahead of these evolving threats. The campaign serves as a reminder of the persistent and adaptive nature of APT actors operating in the region.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On October 15, 2025, Kaspersky published a public report detailing the actor's TTPs, malware, infrastructure patterns, and indicators of compromise including file hashes and C2 domains and IP addresses. The report documented the group's evolution and current targeting focus.
A key objective of the operation was exfiltration of sensitive data, including files shared through WhatsApp Desktop and Chrome browser data such as cookies and tokens. These artifacts could expose WhatsApp-related information from compromised systems.
Kaspersky reported that MemLoader Edge decrypts and reflectively loads a vxRat-derived backdoor called “VRat.” The malware includes additional sandbox-evasion behavior as part of the group's 2025 toolset.
During the 2025 activity, Mysterious Elephant relied heavily on PowerShell for staging and persistence and used custom or modified open-source tools including the BabShell reverse shell and MemLoader modules. MemLoader HidenDesk was used for in-memory loading, including Remcos RAT, with anti-sandbox and hidden-desktop techniques.
By 2025, the group had evolved its operations to emphasize spear phishing, exploit kits, and malicious documents for initial compromise. The campaign continued to focus on diplomatic and government-related targets in South Asia.
In its earlier operations, the actor used attack chains resembling Confucius tradecraft, including remote template injection and exploitation of CVE-2017-11882 for initial access. These techniques predated the group's later 2025 tooling and delivery changes.
Kaspersky GReAT identified the threat actor it tracks as “Mysterious Elephant” in 2023. The group was observed targeting government and foreign affairs entities in the Asia-Pacific region, especially in South Asia and particularly Pakistan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The advanced persistent threat (APT) group known as Confucius has intensified its cyber-espionage operations against Pakistani targets by evolving its malware arsenal and attack techniques. Confucius, active since 2013 and believed to be linked to India-sponsored cyber operations, has historically targeted government agencies, military organizations, defense contractors, and critical industries in Pakistan. Recent research by FortiGuard Labs reveals a significant shift in the group’s tactics, moving from the use of infostealers to more sophisticated Python-based backdoors. The group’s latest campaigns have leveraged spear-phishing emails and malicious documents as initial access vectors, a hallmark of their operations over the past decade. In December 2024, Confucius used a phishing campaign that delivered WooperStealer via a malicious .PPSX file, utilizing DLL side-loading techniques to compromise Windows-based systems. This was followed by another wave in March 2025, where Windows shortcut (.LNK) files were used to sideload the WooperStealer DLL, enabling the theft of sensitive data from infected hosts. By August 2025, the group had further refined its approach, using .LNK files to sideload a rogue DLL that deployed Anondoor, a Python-based implant. Anondoor is capable of exfiltrating device information, executing commands, taking screenshots, enumerating files and directories, and dumping passwords from Google Chrome, providing the attackers with persistent surveillance capabilities. The use of Anondoor was first documented by Seebug's KnownSec 404 Team in July 2025, highlighting the group’s ongoing innovation. Confucius has demonstrated strong adaptability by layering obfuscation techniques to evade detection and tailoring its toolset to shifting intelligence-gathering priorities. The group’s campaigns illustrate a clear evolution from short-term data theft to long-term monitoring and persistence within targeted networks. Researchers warn that this shift represents a significant increase in the group’s technical sophistication and operational objectives. The attacks underscore the persistent threat posed by state-sponsored actors in the South Asian region, particularly as they continue to refine their methods to bypass security controls. The campaigns have primarily targeted Microsoft Windows environments, exploiting common user behaviors such as opening email attachments and shortcut files. The group’s ability to rapidly adapt its malware and delivery mechanisms poses ongoing challenges for defenders. Security experts recommend heightened vigilance, user education, and robust endpoint protection to mitigate the risks associated with such advanced threats. The continued targeting of critical sectors in Pakistan by Confucius highlights the geopolitical motivations driving these cyber-espionage activities. Organizations in the region are urged to monitor for indicators of compromise related to WooperStealer and Anondoor and to implement layered security measures to detect and respond to such threats.
Jun 29, 2026
SideWinder, a known advanced persistent threat (APT) group, has launched a sophisticated spear-phishing campaign targeting diplomatic and governmental organizations in South Asia, including a European embassy in New Delhi and entities in Sri Lanka, Pakistan, and Bangladesh. The group has evolved its tactics by adopting a novel infection chain that leverages PDF and ClickOnce-based payloads, in addition to previously used Microsoft Word exploits, to deliver malware such as ModuleInstaller and StealerBot. These attacks, observed in multiple waves from March through September 2025, are designed to compromise sensitive systems and exfiltrate confidential data. The StealerBot malware, a .NET-based implant, is capable of launching reverse shells, delivering additional payloads, and harvesting a wide range of information including screenshots, keystrokes, passwords, and files from infected hosts. ModuleInstaller acts as a downloader for subsequent malicious components. This campaign demonstrates a significant evolution in SideWinder's tactics, techniques, and procedures (TTPs), with phishing emails crafted to appear as official diplomatic communications, using document titles referencing inter-ministerial meetings and regional conflicts. The campaign underscores the persistent threat posed by SideWinder to South Asian diplomatic and governmental targets through advanced social engineering and malware delivery techniques.
Jul 12, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026