Mysterious Elephant APT Breach: Hackers Infiltrate Organization to Steal Sensitive Data
The Mysterious Elephant advanced persistent threat (APT) group has initiated a series of complex intrusions targeting government and foreign policy agencies in the Asia-Pacific region. The operations, active since early 2025, utilize custom-built malware…
The Mysterious Elephant advanced persistent threat (APT) group has initiated a series of complex intrusions targeting government and foreign policy agencies in the Asia-Pacific region. The operations, active since early 2025, utilize custom-built malware modules and modified open-source utilities to extract documents, images, and archives transmitted via WhatsApp.
Initially identified by Kaspersky Lab’s Global Research and Analysis Team (GReAT) in 2023, the group continuously refines its tactics, techniques, and procedures (TTPs) to avoid detection and exfiltrate sensitive data. The group has incorporated code from various other APT actors, including Origami Elephant, Confucius, and SideWinder, to enhance its capabilities.
The group’s operations include the use of spear phishing as a primary entry vector, with highly personalized emails that often involve regional diplomatic themes. These emails contain attachments designed to install malicious payloads upon opening.
Once inside a network, Mysterious Elephant employs a variety of tools. BabShell, a C++-based reverse shell, is a core component that gathers system details and processes instructions from attacker-controlled servers. PowerShell scripts, combined with native Windows utilities like curl and certutil, are used to download additional payloads.
The group has incorporated code from various other APT actors, including Origami Elephant, Confucius, and SideWinder, to enhance its capabilities.
The group uses two variants of the MemLoader reflective PE loader: MemLoader HidenDesk and MemLoader Edge. HidenDesk uses an RC4-like algorithm to decrypt and execute shellcode for fetching a commercial RAT sample in memory. MemLoader Edge performs sandbox-evasion checks and loads a VRat backdoor if sandbox detection fails.
Data exfiltration focuses on WhatsApp artifacts, with modules like Uplo Exfiltrator and Stom Exfiltrator designed to identify and upload targeted file types. ChromeStealer Exfiltrator also harvests cookies, tokens, and Chrome user data, specifically exploiting WhatsApp web transfers.
Geographic Focus and Defensive Measures
Mysterious Elephant primarily targets government and foreign affairs agencies in Pakistan, Bangladesh, Sri Lanka, Afghanistan, and Nepal. The attackers leverage a deep understanding of regional political contexts and institutional communication channels to execute precision-targeted phishing attacks.
Organizations are advised to implement rigorous patch management, monitor networks for anomalous scheduled task creation and DNS anomalies, and provide regular phishing awareness training. Collaboration among regional cybersecurity teams and international information sharing is crucial to detect emerging indicators of compromise and disrupt the group’s operations.
By analyzing Mysterious Elephant’s evolving TTPs and adopting proactive security measures, affected entities can enhance their defenses against this persistent and technically advanced adversary.
Based on reporting by GBHackers.