Loading story…
ESET reported that the DoNot Team resumed development of its Android malware after a period of inactivity, releasing a new spyware family called DoNot Go that appears to replace the older Hornbill implant. The malware was distributed through fake or trojanized applications and was linked to a threat actor long associated with espionage activity targeting South Asia, particularly users in India and Pakistan.
The updated implant expanded surveillance capabilities on Android devices, including collecting files, harvesting contact and SMS data, tracking call logs and device location, recording audio, and exfiltrating information to attacker-controlled infrastructure. Researchers said the campaign showed continued operational investment by the group and reflected an effort to modernize its mobile espionage tooling rather than abandon it.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET publicly released a report titled 'DoNot Go! Do not respawn!' describing its findings on the DoNot threat group's activity. The publication marks the disclosure of the research covered by the reference.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lookout reported multiple mobile surveillance campaigns targeting officials, diplomats, military personnel, activists, and other high-value individuals across South Asia and the Middle East. In one campaign, the **Confucius APT** was linked with high confidence to the Android spyware families **Hornbill** and **SunBird**, which targeted people connected to Pakistan’s military and nuclear organizations as well as election officials in Kashmir. The malware could exfiltrate messages, geolocation, media, call records, documents, and **WhatsApp** content, while insecure command-and-control servers exposed more than **18 GB** of stolen data tied to victims in India, Pakistan, Kazakhstan, Europe, the United States, and the UAE. Lookout also detailed the earlier **Stealth Mango** and **Tangelo** surveillance operation, attributed to members of the Pakistani military, which targeted Android and iOS devices used by government officials, diplomats, military personnel, and activists in Pakistan, Afghanistan, India, Iraq, and the UAE. That campaign relied mainly on phishing through fake Facebook personas and, in some cases, physical access rather than exploits, and collected government communications, travel details, identity documents, GPS data, legal and medical records, and photos from sensitive meetings. Lookout said Google updated **Google Play Protect** and removed malicious Android apps from affected devices, while the research also tied the operators to freelance developers associated with other commercial or commodity spyware tools.
Aug 15, 2026
ESET reported that an Android espionage operation dubbed **eXotic Visit** distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom **XploitSPY** malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and **Google Play**. Researchers said the activity appears to have mainly targeted users in **Pakistan** and **India**, and they track the operators as **Virtual Invaders** without a confirmed link to any previously known threat group. The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about **380 compromised accounts** across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Aug 14, 2026
Researchers linked **DoNot APT** (also tracked as `APT-C-35` and Donot Team) to sustained cyberespionage campaigns against government, military, diplomatic, and foreign affairs targets, primarily in South Asia and later against a Southern European foreign ministry. Victims included organizations in Bangladesh, Sri Lanka, Pakistan, and Nepal, with lures themed around regional geopolitics such as Kashmir and diplomatic travel. In the European case, attackers used a spearphishing email impersonating defense officials and a Google Drive-hosted malicious RAR archive; earlier campaigns relied on malicious Office documents, remote-template injection, and compromised or spoofed email accounts to deliver malware aimed at collecting and exfiltrating sensitive data. The group’s tooling evolved across both **Windows** and **Android** operations. Windows intrusions deployed malware families and frameworks including `yty`, **Gedit**, **DarkMusical**, and **LoptikMod**, using techniques such as DLL side-loading, encrypted payloads decrypted in memory, anti-VM and security-product checks, scheduled-task persistence, and HTTPS command-and-control through infrastructure including `.buzz` domains and `totalservices[.]info`. On Android, Cisco Talos described the **Firestarter** loader, which abused **Google Firebase Cloud Messaging** to receive payload URLs, gather identity and geolocation data, and selectively deliver follow-on spyware while maintaining resilience if primary C2 servers were disrupted.
Aug 15, 2026