Loading story…
Researchers tied a series of espionage campaigns in South Asia and the Middle East to overlapping use of InPage-themed lures, exploit documents, backdoors, and command-and-control infrastructure. Analyses of malicious InPage files showed attackers exploiting vulnerabilities in the Urdu word processor to deliver multiple malware families, including CONFUCIUS_B, BioData, and MY24, with lure documents referencing Kashmir, India, militancy, intelligence, and terrorism-related themes. Earlier reporting also documented an InPage zero-day used against financial institutions in Asia, reinforcing that the software had become a recurring intrusion vector in the region.
Trend Micro later connected an actor it called Urpage to Bahamut, Confucius, and Patchwork through shared malware components, phishing sites, exploit documents, and Android spyware activity. One Android sample masqueraded as Threema and covertly captured screenshots of messages, while other operations used Delphi and Visual Basic backdoors and fake websites to infect targets interested in Kashmir, Islam-related services, and regional political issues. Meta said it disrupted Bahamut APT and Patchwork APT social-engineering operations on its platforms, describing fake personas, recruiter and journalist lures, and efforts to hide malware in mobile apps, indicating that these groups continued adapting their espionage tradecraft even after repeated public exposure.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Meta said it took action in first-quarter 2023 against three cyber-espionage operations in South Asia linked to Bahamut APT, Patchwork APT, and state-linked actors in Pakistan. The company said the actors relied heavily on social engineering and low-sophistication malware, and in some cases reduced app capabilities to improve app-store approval chances.
QiAnXin Threat Intelligence Center published analysis of targeted attacks against Pakistan using malicious InPage documents exploiting CVE-2017-12824, and in some cases Office documents exploiting CVE-2018-0798. The report primarily attributed the activity to BITTER APT based on malware and infrastructure overlap, while noting technical links to Patchwork, Bahamut, and Confucius.
Trend Micro published analysis of an unnamed cluster it called Urpage, linking it to Bahamut, Confucius, and Patchwork through shared malware components, infrastructure, and targeting patterns. The report also described Urpage Android spyware, phishing sites, and exploit documents tied to the cluster.
Unit 42 reported three malicious InPage files delivering CONFUCIUS_B, BioData, and MY24, with lure themes tied to Kashmir, India, and militancy. The researchers said the similar shellcode suggested either a common actor or access to a shared exploit builder.
Bellingcat published a case study revisiting Bahamut and describing additional cyber-espionage activity in the Middle East and South Asia. This serves as a public reporting milestone on the actor later discussed alongside Urpage and related clusters.
Securelist published research on an InPage zero-day exploit being used to attack financial institutions in Asia. Later reporting cited this as prior public evidence that InPage was being used as an attack vector.
Trend Micro reported that Google coordinated to remove malicious applications from the Google Play Store that had been advertised by Urpage command-and-control and phishing sites. The apps included Android malware tied to the Urpage campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 76 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
about.fb.com
Open sourceti.qianxin.com
Open sourceblog.trendmicro.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourcebellingcat.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
Patchwork, also tracked as **Dropping Elephant**, has been linked to a cross-platform espionage campaign that used fake PDF lures on Windows and trojanized chat applications on Android to surveil victims across multiple sectors and regions. Reported targets included organizations in government, defense, energy, research, aviation, finance, and technology across Asia, Europe, Türkiye, and the United States, indicating a broad intelligence-collection effort rather than opportunistic cybercrime. On Windows, the operation reportedly relied on a malicious `.lnk` file disguised as a PDF that launched PowerShell, opened a decoy document, created persistence through scheduled tasks, and deployed a remote access tool using DLL side-loading and in-memory payload decryption. On Android, the group used romance-themed social engineering to persuade victims to sideload fake messaging apps such as **Wave Chat**, enabling theft of chats, keystrokes, contacts, files, call data, audio, and camera feeds; reporting on the campaign also cited associated indicators of compromise including domains, URL paths, package names, and malware filenames.
Aug 7, 2026