Confucius Hacker Group Weaponizes Documents to Infect Windows Systems with AnonDoor Malware

The Confucius hacking group has significantly evolved its attack methodologies over the past year, moving from document stealers like WooperStealer to a Python-based backdoor called AnonDoor. According to FortiGuard Labs, the December 2024 campaign sharpened social engineering with weaponised PowerPoint presentations and embedded OLE objects that triggered a VBScript infection chain from remote infrastructure.

By March 2025, the group pivoted to malicious LNK files disguised as legitimate documents, which execute PowerShell commands to download malicious DLLs and decoy PDFs, maintaining the illusion of legitimate access while establishing backdoor access.

In August 2025, AnonDoor was introduced as a sophisticated Python-based backdoor that downloads Python via the Scoop package manager and creates hidden .pyc files in user directories, with the malware able to fingerprint targets and conduct extensive reconnaissance, including WMIC hardware UUID extraction and public IP geolocation.

The operation remains geographically focused on South Asia, particularly Pakistan, and FortiGuard Antivirus has detected components such as LNK/Agent variants, MSOffice/Agent samples, and Python/Agent classifications. The article notes Fortinet protection for organisations using FortiGate, FortiMail, FortiClient, and FortiEDR.