Arctic Wolf Reports Sloppy Lemming Espionage Campaign Targeting Pakistan and Bangladesh
Summary
Arctic Wolf attributes a year-long campaign targeting government and critical infrastructure in Pakistan and Bangladesh to Sloppy Lemming, describing BurrowShell, two payload-delivery chains, and resilient infrastructure.
Key points
- Arctic Wolf attributes the campaign, which ran from January 2025 to January 2026, to Sloppy Lemming, also known as Outrider Tiger and Fishing Elephant.
- The reported targets included government and critical infrastructure in Pakistan and Bangladesh, including nuclear, defense, energy, telecommunications, and financial organizations.
- One delivery chain used PDF lures, ClickOnce manifests, and DLL sideloading to execute the BurrowShell implant.
- A separate chain used macro-enabled Excel documents to deliver a Rust-based keylogger.
- BurrowShell is described as an x64 implant with filesystem control, remote shell execution, screenshot capture, and SOCKS proxy capabilities.
- Arctic Wolf says the campaign used 112 unique domains and Cloudflare Workers, with traffic made to resemble Windows Update communications.
Article Details
- Event Type
- Cyber-espionage campaign
- Impact
- Arctic Wolf attributes a year-long campaign to Sloppy Lemming targeting government and critical infrastructure in Pakistan and Bangladesh. The reported delivery chains deployed the BurrowShell implant and a Rust-based keylogger; BurrowShell supports filesystem manipulation, remote shell execution, screenshot capture, and SOCKS proxying. The article does not report confirmed data theft or other specific victim impact.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationBurrowShell traffic reportedly masqueraded as Windows Update communications.T1090.001 · Internal ProxyBurrowShell reportedly supports SOCKS proxying to tunnel further into a compromised network.T1566.001 · Spearphishing AttachmentThe campaign reportedly sent victims PDF lure documents that redirected them to ClickOnce application manifests.T1574.002 · DLL Side-LoadingThe PDF/ClickOnce delivery chain reportedly used a DLL sideloading package to execute BurrowShell.
Threat Actors
Fishing ElephantThe article identifies Fishing Elephant as another name used to track Sloppy Lemming, which Arctic Wolf attributes to the reported espionage campaign.Outrider TigerThe article identifies Outrider Tiger as another name used to track Sloppy Lemming, which Arctic Wolf attributes to the reported espionage campaign.Sloppy LemmingArctic Wolf attributes the reported year-long espionage campaign targeting government and critical infrastructure in Pakistan and Bangladesh to Sloppy Lemming.
Malware
Vendors
Products
Countries
BangladeshIndia-nexus threat actor Sloppy Lemming against government and critical infrastructure in Pakistan and Bangladesh, revealing a significant expansion in the group’s capabilities and operational reach.IndiaArctic Wolf documents a year-long, highly targeted espionage campaign by the India-nexus threat actor Sloppy Lemming against government and critical infrastructure in Pakistan and Bangladesh, revealing a significantPakistanby the India-nexus threat actor Sloppy Lemming against government and critical infrastructure in Pakistan and Bangladesh, revealing a significant expansion in the group’s capabilities and operational reach.
Industries
DefenseInfrastructure resiliency included Cloudflare Workers and traffic masquerading as Windows Update, prompting urgent defensive measures for nuclear, defense, energy, and telecom sectors.EnergyInfrastructure resiliency included Cloudflare Workers and traffic masquerading as Windows Update, prompting urgent defensive measures for nuclear, defense, energy, and telecom sectors.Governmenta year-long, highly targeted espionage campaign by the India-nexus threat actor Sloppy Lemming against government and critical infrastructure in Pakistan and Bangladesh, revealing a significant expansion in thenuclearInfrastructure resiliency included Cloudflare Workers and traffic masquerading as Windows Update, prompting urgent defensive measures for nuclear, defense, energy, and telecom sectors.TelecommunicationsPakistan: Nuclear regulatory bodies, defense logistics organizations, and telecommunications infrastructure.