Mysterious Elephant is an active APT group targeting government and foreign affairs organizations in the Asia‑Pacific region using spear phishing, exploit chains, custom loaders, and WhatsApp‑focused exfiltration modules. Their 2025 campaign leverages custom tools like BabShell, MemLoader (HidenDesk/Edge), and exfiltrators (Uplo, Stom, ChromeStealer) to steal documents, images, and archived files. #BabShell #MemLoader #Uplo
Keypoints
- Mysterious Elephant, tracked since 2023, combines and maintains code from multiple APTs (Origami Elephant, Confucius, SideWinder) to build evolving toolsets.
- The 2025 campaign shifted to spear phishing, exploit kits, and malicious documents to achieve initial access, focusing on South Asia (notably Pakistan) and diplomatic targets.
- Operators deploy custom and customized open‑source tools including BabShell (reverse shell), MemLoader HidenDesk and MemLoader Edge (reflective in‑memory loaders), and payloads like Remcos/VRat.
- PowerShell scripts are used for payload download/execution and persistence via scheduled tasks triggered by network profile events, with evasion delays configured.
- Exfiltration is tailored to WhatsApp data and common sensitive file types using specialized modules: Uplo (targeted file extensions), Stom (WhatsApp transfers path), and ChromeStealer (Chrome profile data).
- Infrastructure employs many domains, wildcard DNS techniques, VPS and cloud hosts to generate unique names per request and hinder tracking.
- Primary victims are government and foreign affairs entities across Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka, with highly tailored lures and payloads.
MITRE Techniques
- [T1566] Phishing – Tailored spear phishing emails used to deliver malicious documents as convincing lures (e.g., “Pakistan’s application for a non-permanent seat on the United Nations Security Council”).
- [T1204.002] User Execution: Malicious File – Malicious decoy documents used to trigger exploitation and deploy downloaders such as Vtyrei and next‑stage payloads.
- [T1203] Exploitation for Client Execution – Use of exploit chains including CVE-2017-11882 and exploit kits to achieve code execution from documents.
- [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell scripts loaded from C2 to download payloads, schedule tasks, and establish persistence (downloads ping.exe and schedules a network-profile-triggered task with a four-hour delay).
- [T1105] Ingress Tool Transfer – Download of additional payloads and modules (e.g., BabShell, MemLoader modules) from attacker-controlled C2 servers using curl/certutil).
- [T1055] Process Injection – MemLoader HidenDesk and MemLoader Edge perform reflective in‑memory loading of decrypted PE payloads (Remcos, VRat) to execute code without touching disk.
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – MemLoader HidenDesk creates a shortcut in the autostart folder to ensure persistence after reboot.
- [T1020] Automated Exfiltration – Exfiltration modules (Uplo, Stom, ChromeStealer) recursively collect targeted files and transfer them to C2 servers using obfuscated domain paths and encoding (XOR, Base64).
- [T1071.001] Application Layer Protocol: Web Protocols – Use of HTTP(S) C2 channels and custom domains/IPs to receive commands and exfiltrate data (multiple domains listed in infrastructure section).
- [T1496] Resource Hijacking / Data from Local System – Targeted collection of WhatsApp shared files from %AppData%Packagesxxxxx.WhatsAppDesktop_[WhatsApp ID]LocalStateSharedtransfers to steal documents and media.
Indicators of Compromise
- [File Hashes] Malicious payloads and loaders – BabShell: 85c7f209a8fa47285f08b09b3868c2a1f947ff7fb94fa35a532f8a7d99181cf1; MemLoader HidenDesk STI.dll: 658eed7fcb6794634bbdd7f272fcf9c6.
- [File Hashes] Exfiltrators and droppers – Uplo Exfiltrator SXSHARED.dll: cf1d14e59c38695d87d85af76db9a861; ChromeStealer WhatsAppOB.exe: 9e50adb6107067ff0bab73307f5499b6.
- [File Names] Dropped/executed files and artifacts – ping.exe (used by PowerShell downloader and Stom exfiltrator), Edge.exe/debugger.exe/runtime.exe (associated with MemLoader Edge).
- [Domains] C2 and staging domains – storycentral[.]net, monsoonconference[.]com, cloud.givensolutions[.]online:4443, solutions.fuzzy-network[.]tech (used as C2/staging infrastructure and to host payloads).
- [IPs] Hosting/infrastructure IP addresses – 91.132.95[.]148, 62.106.66[.]80, 158.255.215[.]45 (examples of IPs used in the actor’s infrastructure).
- [Malicious Documents] Lure filenames – 2025-013-PAK-MoD-Invitation_the_UN_Peacekeeping.rar (contains malicious document), M6XA.rar (malicious document archive).
Read more: https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/