Loading story…
Palo Alto Networks detailed two related malware families, CONFUCIUS_A and CONFUCIUS_B, that concealed command-and-control discovery inside traffic to legitimate web services including Quora and Yahoo Answers. Instead of performing direct DNS lookups, the malware parsed words embedded in public web content and translated them into IP addresses through lookup tables, allowing early-stage beaconing to blend into normal browsing activity. Researchers said the uncommon resolver technique and code similarities point to a shared developer or development shop, even though the campaigns were likely operated separately.
CONFUCIUS_A was linked through overlapping infrastructure to SNEEPY/ByeByeShell activity and was observed primarily targeting organizations in Pakistan, the Middle East, and parts of Asia, with some broader enterprise victims also seen. CONFUCIUS_B used a similar concept with a different implementation, including delivery through a self-extracting RAR archive disguised with RTLO as a PowerPoint file, followed by scripts and a second-stage executable; it also showed looser ties to Patchwork/Hangover through shared infrastructure, mutexes, and certificate relationships.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
On this date, the domain com-account-jfnjkr.xyz hosted a basic file stealer associated with Patchwork via the shared mutex {9754893678976458374658764387563876}. The same domain was also used as command-and-control infrastructure for a sample that downloaded CONFUCIUS_B, creating a loose link between the clusters.
The attackers behind CONFUCIUS_A were observed dropping the backdoor starting in early 2014. The malware was commonly delivered via executable files sent directly to targets by email.
Rapid7 first reported attacks associated with the SNEEPY, or ByeByeShell, backdoor method against Pakistani targets. Later analysis linked CONFUCIUS_A to this earlier activity through overlapping infrastructure.
Unit 42 published research on the related malware families CONFUCIUS_A and CONFUCIUS_B, describing how they abused Yahoo Answers and Quora to derive command-and-control addresses from legitimate web traffic. The report assessed that the unusual shared technique suggested a common developer or development shop, though likely different operators used the two clusters.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 166 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The advanced persistent threat (APT) group known as Confucius has intensified its cyber-espionage operations against Pakistani targets by evolving its malware arsenal and attack techniques. Confucius, active since 2013 and believed to be linked to India-sponsored cyber operations, has historically targeted government agencies, military organizations, defense contractors, and critical industries in Pakistan. Recent research by FortiGuard Labs reveals a significant shift in the group’s tactics, moving from the use of infostealers to more sophisticated Python-based backdoors. The group’s latest campaigns have leveraged spear-phishing emails and malicious documents as initial access vectors, a hallmark of their operations over the past decade. In December 2024, Confucius used a phishing campaign that delivered WooperStealer via a malicious .PPSX file, utilizing DLL side-loading techniques to compromise Windows-based systems. This was followed by another wave in March 2025, where Windows shortcut (.LNK) files were used to sideload the WooperStealer DLL, enabling the theft of sensitive data from infected hosts. By August 2025, the group had further refined its approach, using .LNK files to sideload a rogue DLL that deployed Anondoor, a Python-based implant. Anondoor is capable of exfiltrating device information, executing commands, taking screenshots, enumerating files and directories, and dumping passwords from Google Chrome, providing the attackers with persistent surveillance capabilities. The use of Anondoor was first documented by Seebug's KnownSec 404 Team in July 2025, highlighting the group’s ongoing innovation. Confucius has demonstrated strong adaptability by layering obfuscation techniques to evade detection and tailoring its toolset to shifting intelligence-gathering priorities. The group’s campaigns illustrate a clear evolution from short-term data theft to long-term monitoring and persistence within targeted networks. Researchers warn that this shift represents a significant increase in the group’s technical sophistication and operational objectives. The attacks underscore the persistent threat posed by state-sponsored actors in the South Asian region, particularly as they continue to refine their methods to bypass security controls. The campaigns have primarily targeted Microsoft Windows environments, exploiting common user behaviors such as opening email attachments and shortcut files. The group’s ability to rapidly adapt its malware and delivery mechanisms poses ongoing challenges for defenders. Security experts recommend heightened vigilance, user education, and robust endpoint protection to mitigate the risks associated with such advanced threats. The continued targeting of critical sectors in Pakistan by Confucius highlights the geopolitical motivations driving these cyber-espionage activities. Organizations in the region are urged to monitor for indicators of compromise related to WooperStealer and Anondoor and to implement layered security measures to detect and respond to such threats.
Jun 29, 2026
Researchers tied a series of espionage campaigns in South Asia and the Middle East to overlapping use of **InPage-themed lures**, exploit documents, backdoors, and command-and-control infrastructure. Analyses of malicious InPage files showed attackers exploiting vulnerabilities in the Urdu word processor to deliver multiple malware families, including `CONFUCIUS_B`, **BioData**, and **MY24**, with lure documents referencing Kashmir, India, militancy, intelligence, and terrorism-related themes. Earlier reporting also documented an InPage zero-day used against financial institutions in Asia, reinforcing that the software had become a recurring intrusion vector in the region. Trend Micro later connected an actor it called **Urpage** to **Bahamut**, **Confucius**, and **Patchwork** through shared malware components, phishing sites, exploit documents, and Android spyware activity. One Android sample masqueraded as **Threema** and covertly captured screenshots of messages, while other operations used Delphi and Visual Basic backdoors and fake websites to infect targets interested in Kashmir, Islam-related services, and regional political issues. Meta said it disrupted **Bahamut APT** and **Patchwork APT** social-engineering operations on its platforms, describing fake personas, recruiter and journalist lures, and efforts to hide malware in mobile apps, indicating that these groups continued adapting their espionage tradecraft even after repeated public exposure.
Aug 15, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026