Loading story…
Researchers attributed a targeted cyber-espionage intrusion against Bangladesh military and defense personnel to DoNot (also tracked as APT-C-35). The campaign reportedly began with a spear-phishing RTF document themed as the biography of a Bangladesh Air Force officer, using remote template injection to pull a malicious VBA macro. Delivery was restricted with server-side geofencing so that later stages were served only to intended victims in the target region.
The infection chain used architecture-aware shellcode injection and several XOR-encoded payload stages retrieved from the same command-and-control infrastructure while masquerading as benign files such as .ico, .mp3, and .doc. The final payload was a DLL implant that established scheduled-task persistence disguised as OneDrive telemetry, profiled infected hosts, and communicated with a secondary HTTPS C2 using AES-128-CBC. Researchers said they also recovered a live second-stage module, ejtest.dll, from active infrastructure and found hardcoded AES key material matching previously documented DoNot tooling.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
During the investigation, researchers obtained a live second-stage DoNot module, ejtest.dll, directly from active command-and-control infrastructure. They reported that its hardcoded AES key material matched previously documented DoNot tooling, reinforcing the attribution.
Researchers documented a cyber-espionage intrusion attributed to DoNot (APT-C-35) targeting Bangladesh's military and defense establishment. The campaign used a spear-phishing RTF lure themed as the biography of a Bangladesh Air Force officer and a multi-stage malware chain with geofenced delivery and scheduled-task persistence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalware.news
Open sourcecyderes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **DoNot APT** (also tracked as `APT-C-35` and Donot Team) to sustained cyberespionage campaigns against government, military, diplomatic, and foreign affairs targets, primarily in South Asia and later against a Southern European foreign ministry. Victims included organizations in Bangladesh, Sri Lanka, Pakistan, and Nepal, with lures themed around regional geopolitics such as Kashmir and diplomatic travel. In the European case, attackers used a spearphishing email impersonating defense officials and a Google Drive-hosted malicious RAR archive; earlier campaigns relied on malicious Office documents, remote-template injection, and compromised or spoofed email accounts to deliver malware aimed at collecting and exfiltrating sensitive data. The group’s tooling evolved across both **Windows** and **Android** operations. Windows intrusions deployed malware families and frameworks including `yty`, **Gedit**, **DarkMusical**, and **LoptikMod**, using techniques such as DLL side-loading, encrypted payloads decrypted in memory, anti-VM and security-product checks, scheduled-task persistence, and HTTPS command-and-control through infrastructure including `.buzz` domains and `totalservices[.]info`. On Android, Cisco Talos described the **Firestarter** loader, which abused **Google Firebase Cloud Messaging** to receive payload URLs, gather identity and geolocation data, and selectively deliver follow-on spyware while maintaining resilience if primary C2 servers were disrupted.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026