Arctic Wolf Attributes Espionage Campaign Targeting Pakistan, Bangladesh and Sri Lanka to SloppyLemming
Summary
Arctic Wolf says the SloppyLemming actor ran a year-long espionage campaign from January 2025 against government and critical-infrastructure targets in Pakistan, Bangladesh and Sri Lanka, using malicious PDFs, Excel implants and 112 Cloudflare domains.
Key points
- Arctic Wolf attributed the campaign to the India-nexus actor SloppyLemming and said it began in January 2025.
- Attackers reportedly used social-engineered emails with malicious PDFs or Excel documents to lure targets.
- PDF-delivered BurrowShell could take screenshots and manipulate files; Excel implants included keylogging and reconnaissance capabilities.
- The researchers said 112 Cloudflare domains staged malware and used Pakistani and Bangladeshi government-themed names.
- Reported targets included Pakistani government, defense, nuclear-regulatory and telecom organizations, as well as Bangladeshi energy and financial institutions.
- Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion alongside exposed directories and inconsistent operational security.
Article Details
- Event Type
- Cyber-espionage campaign involving spearphishing and malicious documents, attributed by Arctic Wolf to SloppyLemming.
- Impact
- The campaign targeted government agencies and critical infrastructure in Pakistan, Bangladesh, and Sri Lanka. Reported capabilities included credential harvesting, keylogging, screenshots, file-system manipulation, persistence, and network reconnaissance. Arctic Wolf described the operation as India-nexus; the article does not report a confirmed attribution to the Indian government.
MITRE ATT&CK
T1046 · Network Service DiscoveryThe malware was reported to perform network scanning.T1056.001 · KeyloggingThe Excel-based implants included keylogging capabilities.T1113 · Screen CaptureBurrowShell was reported to take screenshots.T1204.002 · Malicious FileVictims were prompted to open malicious PDF or Excel documents to enable access.T1566.001 · Spearphishing AttachmentThe campaign typically began with spearphishing emails containing malicious documents.
Threat Actors
Outrider TigerCloudflare reportedly said the campaign aligned with a threat actor tracked by Crowdstrike under this name; Cloudflare did not link the campaign to actors in India.SloppyLemmingArctic Wolf attributed the espionage campaign to this India-nexus threat actor, which the researchers said had conducted cyber-espionage attacks since at least 2021.
Malware
Products
Countries
Bangladeshrunning from January 2025 targeted government agencies and critical infrastructure in Pakistan, Bangladesh and Sri Lanka, using social-engineered emails and 112 Cloudflare domains to stage malicious documents.IndiaArctic Wolf attributed the year-long operation to an India-nexus actor dubbed SloppyLemming, which deployed the BurrowShell backdoor and Excel-based keyloggers to capture screenshots, harvest credentials and performPakistanespionage campaign running from January 2025 targeted government agencies and critical infrastructure in Pakistan, Bangladesh and Sri Lanka, using social-engineered emails and 112 Cloudflare domains to stage maliciousSri Lankafrom January 2025 targeted government agencies and critical infrastructure in Pakistan, Bangladesh and Sri Lanka, using social-engineered emails and 112 Cloudflare domains to stage malicious documents.
Industries
Critical infrastructureAn espionage campaign running from January 2025 targeted government agencies and critical infrastructure in Pakistan, Bangladesh and Sri Lanka, using social-engineered emails and 112 Cloudflare domains to stageDefenseactor operating with moderate capability: the multi-stage execution chains demonstrate understanding of defense evasion techniques and shows familiarity with Windows internals, while the operational security failuresEnergyreconnaissance against entities like the Pakistan Nuclear Regulatory Authority and major telecom and energy providers.GovernmentAn espionage campaign running from January 2025 targeted government agencies and critical infrastructure in Pakistan, Bangladesh and Sri Lanka, using social-engineered emails and 112 Cloudflare domains to stageTelecommunicationsbodies like the Pakistan Nuclear Regulatory Authority, defense logistics organizations, and telecommunications infrastructure – alongside Bangladeshi energy utilities and financial institutions.