Loading story…
Researchers linked DoNot APT (also tracked as APT-C-35 and Donot Team) to sustained cyberespionage campaigns against government, military, diplomatic, and foreign affairs targets, primarily in South Asia and later against a Southern European foreign ministry. Victims included organizations in Bangladesh, Sri Lanka, Pakistan, and Nepal, with lures themed around regional geopolitics such as Kashmir and diplomatic travel. In the European case, attackers used a spearphishing email impersonating defense officials and a Google Drive-hosted malicious RAR archive; earlier campaigns relied on malicious Office documents, remote-template injection, and compromised or spoofed email accounts to deliver malware aimed at collecting and exfiltrating sensitive data.
The group’s tooling evolved across both Windows and Android operations. Windows intrusions deployed malware families and frameworks including yty, Gedit, DarkMusical, and LoptikMod, using techniques such as DLL side-loading, encrypted payloads decrypted in memory, anti-VM and security-product checks, scheduled-task persistence, and HTTPS command-and-control through infrastructure including .buzz domains and totalservices[.]info. On Android, Cisco Talos described the Firestarter loader, which abused Google Firebase Cloud Messaging to receive payload URLs, gather identity and geolocation data, and selectively deliver follow-on spyware while maintaining resilience if primary C2 servers were disrupted.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
Trellix reported that the malware collected host information, encrypted it with AES, encoded it with Base64, and sent it via HTTP POST to totalservices[.]info. Based on server responses, it could download a follow-on payload named socker.dll and prepare additional persistence through a scheduled task named "MicorsoftVelocity."
Trellix found that executing notflog.exe created a mutex, dropped a batch file under %LocalAppdata%\TEMP\FROX\, and established persistence with a scheduled task named "PerformTaskMaintain" running every 10 minutes. The sample used obfuscation, runtime API loading, anti-VM checks, and code overlap that linked it to DoNot's LoptikMod malware family.
In the 2025 campaign, attackers sent a spear-phishing email from int.dte.afd.1@gmail[.]com with the subject "Italian Defence Attaché Visit to Dhaka, Bangladesh" and a Google Drive link. The link delivered a password-protected archive named SyClrLtr.rar containing the disguised executable notflog.exe.
Trellix documented a 2025 cyber-espionage campaign attributed to DoNot targeting a Southern European government entity in the diplomatic sector, described as a European foreign affairs ministry. The operation showed the group's interest expanding beyond its usual South Asian focus into European diplomatic targets.
K7 reported that a January 2023 sample in the campaign was named "Kashmir Solidarity Day Material .exe." This sample was part of the same DoNot activity cluster tied to .buzz command-and-control infrastructure.
K7 reported campaign samples spanning from September 2022 through January 2023 and linked them to DoNot infrastructure using .buzz domains registered through NameSilo and hosting associated with BitLaunch VPS services. The September 2022 campaign included a sample named "bodli.doc."
Talos reported that DoNot was using a newly discovered Android malware loader called Firestarter, which relied on Google Firebase Cloud Messaging to receive payload URLs and maintain operator control. The campaign targeted users and non-profit organizations associated with India, Pakistan, and the Kashmir region.
ESET said it monitored DoNot Team campaigns from September 2020 to October 2021 and observed spearphishing waves every two to four months. The operations targeted government, military, foreign affairs, and embassy entities in Bangladesh, Sri Lanka, Pakistan, and Nepal, including embassies abroad.
QiAnXin analyzed a recent Donot campaign using macro-enabled Office documents and remote-template injection documents that fetched Equation Editor exploit content, then downloaded loader DLLs and encrypted payloads. Researchers assessed the targeting included Sri Lanka and nearby regions, with persistence via startup links or scheduled tasks.
Multiple references state that DoNot APT, also tracked as APT-C-35, has been active since at least 2016. The group is described as targeting South Asian organizations with Windows and Android malware.
K7 observed DoNot changing its initial access technique from malicious Office documents to a ZIP archive named "Day .zip" containing a WinRAR SFX executable, a DLL, and Kashmir-themed decoy PDFs. The DLL created the mutex "olgui1pigg," attempted C2 contact, collected host data, and established persistence with a scheduled task running every four minutes.
ESET analyzed the yty malware variants Gedit and DarkMusical and reported that DarkMusical was used in campaigns targeting military organizations in Bangladesh and Nepal. The malware family was part of DoNot's Windows espionage toolset for data collection and exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 89 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourcelabs.k7computing.com
Open sourceeset.com
Open sourceblog.talosintelligence.com
Open sourceti.qianxin.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed a targeted cyber-espionage intrusion against Bangladesh military and defense personnel to **DoNot** (also tracked as **APT-C-35**). The campaign reportedly began with a spear-phishing **RTF** document themed as the biography of a Bangladesh Air Force officer, using remote template injection to pull a malicious VBA macro. Delivery was restricted with server-side geofencing so that later stages were served only to intended victims in the target region. The infection chain used architecture-aware shellcode injection and several XOR-encoded payload stages retrieved from the same command-and-control infrastructure while masquerading as benign files such as `.ico`, `.mp3`, and `.doc`. The final payload was a DLL implant that established scheduled-task persistence disguised as OneDrive telemetry, profiled infected hosts, and communicated with a secondary HTTPS C2 using **AES-128-CBC**. Researchers said they also recovered a live second-stage module, `ejtest.dll`, from active infrastructure and found hardcoded AES key material matching previously documented DoNot tooling.
Jul 23, 2026
The **Bitter** espionage group, also tracked as **TA397** and **APT-Q-37**, has conducted sustained targeting across South Asia and neighboring regions, hitting government, military, energy, engineering, and other sensitive organizations in countries including **Bangladesh, Pakistan, Saudi Arabia, and China**. Researchers linked the activity through overlapping command-and-control infrastructure, recurring phishing lures, and repeated use of malicious Office documents, MSI installers, SFX archives, and compromised legitimate websites. In one campaign against Bangladeshi law-enforcement officials, spear-phishing emails delivered weaponized RTF and Excel files that exploited known Microsoft Office flaws to install the **ZxxZ** trojan, while earlier operations against Pakistan and Saudi Arabia used **ArtraDownloader**, including samples exploiting `CVE-2017-11882` via Microsoft Equation Editor.
Aug 15, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026