{"id":134,"date":"2026-03-03T09:56:56","date_gmt":"2026-03-03T09:56:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=134"},"modified":"2026-03-03T09:56:56","modified_gmt":"2026-03-03T09:56:56","slug":"sloppylemming-targets-pakistan-and-bangladesh-governments-using-dual-malware-chains","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=134","title":{"rendered":"SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 03, 2026<\/span><\/span>Malware \/ Phishing<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The threat activity cluster known as SloppyLemming<\/strong> has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in Pakistan and Bangladesh.<\/p>\n

The activity, per Arctic Wolf, took place between January 2025 and January 2026. It involves the use of two distinct attack chains to deliver malware families tracked as BurrowShell and a Rust-based keylogger.\u00a0<\/p>\n

\u00abThe use of the Rust programming language represents a notable evolution in SloppyLemming\u2019s tooling, as prior reporting documented the actor using only traditional compiled languages and borrowed adversary simulation frameworks such as Cobalt Strike, Havoc, and the custom NekroWire RAT,\u00bb the cybersecurity company said<\/a> in a report shared with The Hacker News.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

SloppyLemming is the moniker assigned to a threat actor that’s known to target government, law enforcement, energy, telecommunications, and technology entities in Pakistan, Sri Lanka, Bangladesh, and China since at least 2022. It’s also tracked under the names Outrider Tiger<\/a> and Fishing Elephant.<\/p>\n

Prior campaigns mounted by the hacking crew have leveraged malware families like Ares RAT and WarHawk, which are often attributed to SideCopy and SideWinder, respectively.<\/p>\n

ArcticWolf’s analysis of the latest attacks has uncovered the use of spear-phishing emails to deliver PDF lures and macro-enabled Excel documents to kick-start the infection chains. It described the threat actor as operating with moderate capability.<\/p>\n

The PDF decoys contain URLs designed to lead victims to ClickOnce application manifests, which then deploy a legitimate Microsoft .NET runtime executable (\u00abNGenTask.exe\u00bb) and a malicious loader (\u00abmscorsvc.dll\u00bb). The loader is launched using DLL side-loading to decrypt and execute a custom x64 shellcode implant codenamed BurrowShell.<\/p>\n

\"\"<\/a><\/div>\n

\u00abBurrowShell is a full-featured backdoor providing the threat actor with file system manipulation, screenshot capture capabilities, remote shell execution, and SOCKS proxy capabilities for network tunneling,\u00bb Arctic Wolf said. \u00abThe implant masquerades its command-and-control (C2) traffic as Windows Update service communications and employs RC4 encryption with a 32-character key for payload protection.\u00bb<\/p>\n

The second attack chain employs Excel documents containing malicious macros to drop the keylogger malware, while also incorporating features to conduct port scanning and network enumeration.<\/p>\n

Further investigation of the threat actor’s infrastructure has identified 112 Cloudflare Workers domains registered during the one-year time period, marking an eight-fold jump from the 13 domains flagged by Cloudflare in September 2024.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The campaign’s links to SloppyLemming are based on continued exploitation of Cloudflare Workers infrastructure with government-themed typo-squatting patterns, deployment of the Havoc C2 framework, DLL side-loading techniques, and victimology patterns.<\/p>\n

It’s worth noting that some aspects of the threat actor’s tradecraft, including the use of ClickOnce-enabled execution, overlap with a recent SideWinder campaign documented by Trellix in October 2025.<\/p>\n

\u00abIn particular, the targeting of Pakistani nuclear regulatory bodies, defense logistics organizations, and telecommunications infrastructure \u2013 alongside Bangladeshi energy utilities and financial institutions \u2013 aligns with intelligence collection priorities consistent with regional strategic competition in South Asia,\u00bb Arctic Wolf said.<\/p>\n

\u00abThe deployment of dual payloads \u2013 the in-memory shellcode BurrowShell for C2 and SOCKS proxy operations, and a Rust-based keylogger for information stealing \u2013 suggests the threat actor maintains flexibility to deploy appropriate tools based on target value and operational requirements.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Mar 03, 2026Malware \/ Phishing The threat activity cluster known as SloppyLemming has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in…<\/p>\n","protected":false},"author":1,"featured_media":135,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[377,380,379,378,42,376,375,78],"class_list":["post-134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-bangladesh","tag-chains","tag-dual","tag-governments","tag-malware","tag-pakistan","tag-sloppylemming","tag-targets"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=134"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/134\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/135"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}