Loading story…
Arctic Wolf reported an India-nexus espionage campaign attributed to SloppyLemming (aka Outrider Tiger / Fishing Elephant) targeting government entities and critical infrastructure operators in Pakistan and Bangladesh (with additional reporting noting Sri Lanka). The activity, tracked from January 2025 to January 2026, used two main infection chains: (1) PDF lure documents that redirected victims to ClickOnce manifests, deploying a DLL sideloading package using a legitimate .NET runtime executable (NGenTask.exe) alongside a malicious loader (mscorsvc.dll) that decrypted and executed a custom x64 shellcode implant dubbed BurrowShell; and (2) macro-enabled Excel lures delivering a Rust-based keylogger/recon tool with capabilities including port scanning and network enumeration. BurrowShell was described as a full-featured backdoor enabling file operations, screenshot capture, remote shell execution, and SOCKS proxy tunneling, while attempting to blend in by masquerading C2 as Windows Update traffic and using RC4 with a 32-character key for payload protection.
Infrastructure analysis tied the campaign to 112 Cloudflare Workers domains registered during the tracking period—an expansion in scale compared to prior public reporting—and included government-themed domain naming intended to increase victim trust. Reported targets included Pakistani nuclear regulatory and defense-adjacent organizations (e.g., the Pakistan Nuclear Regulatory Authority, Pakistan Navy, and logistics/telecom entities) and Bangladeshi energy and financial-sector organizations (including power grid/utility operators). Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion knowledge alongside operational security lapses (e.g., exposed directories), and noted the activity as an expansion of threat activity previously identified publicly by Cloudflare.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On March 2, 2026, Arctic Wolf published a report attributing the year-long espionage campaign to SloppyLemming with moderate confidence. The report detailed the BurrowShell backdoor, the Rust-based RAT/keylogger, targeting in Pakistan and Bangladesh, and the actor's expanded use of Cloudflare Workers infrastructure.
Arctic Wolf said the activity it analyzed ran from January 2025 through January 2026. By the end of that period, the actor had used 112 Cloudflare Workers domains, representing a substantial expansion of its delivery and command-and-control infrastructure.
At some point during the 2025-2026 campaign, researchers identified three open-directory misconfigurations on SloppyLemming infrastructure. The exposed directories revealed staged malware and components associated with the Havoc framework, highlighting operational security failures by the actor.
In October 2025, Trellix published reporting on a SideWinder campaign whose tactics, techniques, and procedures partially overlapped with activity later documented by Arctic Wolf. Arctic Wolf noted the similarities but assessed key differences that supported tracking SloppyLemming as a distinct cluster.
Also during the campaign, SloppyLemming used macro-enabled Excel lures to deliver a second malware chain involving a renamed legitimate Microsoft binary and a sideloaded Rust-based payload. The malware provided keylogging, command execution, file operations, screenshots, port scanning, and network enumeration.
During the campaign, SloppyLemming used PDF lures that redirected victims to ClickOnce manifests, leading to DLL sideloading via a renamed legitimate .NET binary and execution of the BurrowShell backdoor. BurrowShell supported remote shell access, file operations, screenshots, and SOCKS proxying while disguising command-and-control traffic as Windows Update over HTTPS.
Around January 2025, the India-nexus threat actor SloppyLemming began a cyber-espionage campaign targeting government agencies and critical infrastructure in Pakistan and Bangladesh, with some reporting also noting Sri Lanka. The operation relied on spear-phishing and social engineering to reach victims in sectors including defense, telecom, energy, finance, and nuclear regulation.
In September 2024, Cloudflare reported abuse of Cloudflare Workers infrastructure linked to activity associated with CrowdStrike's India-nexus actor Outrider Tiger. Arctic Wolf later cited this as prior related reporting and noted a major increase in such domains afterward.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcearcticwolf.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026