Confucius APT Evolves: Espionage Group Shifts from WooperStealer to Advanced Python Backdoor AnonDoor

The Confucius group, a long-running cyber-espionage actor first identified in 2013, has resurfaced with a new wave of operations across South Asia, with Fortinet noting that the group targets governments, military organisations, defence contractors and critical industries, particularly in Pakistan.

According to Fortinet, they have moved from legacy stealers such as WooperStealer to advanced Python-based backdoors like AnonDoor, while continuing to use weaponised Office documents, malicious LNK files and layered obfuscation to evade detection.

In late 2024 the group ran a phishing campaign against users in Pakistan, delivering a dropper via a VBScript inside a document with a fake “Corrupted Page” error, which ultimately deployed WooperStealer and exfiltrated a wide range of data to attacker‑controlled servers. By early 2025 Confucius shifted to LNK-based infection chains, with one sample dropping a decoy PDF and sideloading a DLL, and the final payload again identified as WooperStealer but with a narrowed target list of file extensions.

The latest observed campaigns introduced a Python-based AnonDoor variant delivered through another malicious LNK, which loads a Python runtime via a DLL side-load and uses scheduled tasks to persist, while also featuring a PasswordDumper module and capabilities to capture screenshots, inventory drives and execute commands.

FortiGuard Labs concludes that the group has continually evolved its techniques, adopting diverse file types and access vectors to evade detection, and cycling between WooperStealer, MSIL-based AnonDoor, and Python-based AnonDoor to sustain its espionage objectives.