Mysterious Elephant: a growing threat

Mysterious Elephant is described as a highly active advanced persistent threat (APT) group that Kaspersky GReAT has tracked since 2023, with a focus on government entities and foreign affairs sectors in the Asia-Pacific region and a notable interest in Pakistan. Their latest campaign, which began in early 2025, marks a shift to a mix of exploit kits, phishing emails and malicious documents, followed by deployment of a range of custom-made and open-source tools.

The group has integrated new modules such as BabShell, a reverse shell written in C++, and MemLoader HidenDesk, a reflective PE loader that operates in memory, into their operations. They are also using WhatsApp-specific exfiltration tools to steal data from compromised systems, including targeted exports of documents, pictures and other files, with tools like Uplo Exfiltrator, Stom Exfiltrator and ChromeStealer Exfiltrator.

In their PowerShell and loader tooling, they download payloads, schedule tasks for persistence, and use encryption and evasion techniques to conceal in-memory execution. According to Kaspersky GReAT, the threat continues to evolve, emphasising customised payloads, varied infrastructure, and targeted phishing to access diplomatic and government targets in SA countries such as Pakistan.