'Confucius' Cyberspy Evolves From Stealers to Backdoors in Pakistan

A long-running South Asian advanced persistent threat group known as Confucius has shifted its cyber-espionage tactics in Pakistan, moving from deploying infostealers to more advanced Python-based backdoors against Windows targets, researchers warn. FortiGuard Labs uncovered the change, noting the group has been active since 2013 and has previously targeted Pakistan’s government, military, and defence contractors using spear-phishing and malicious documents.

According to the researchers, Confucius moved away from stealer payloads such as WooperStealer and is eyeing long-term monitoring and persistence with backdoors like AnonDoor, while also diversifying initial-access vectors with obfuscated files, LNKs and PowerShell loaders.

The evolution was observed across phishing campaigns from last December through August, with the August operation embedding the Python-based AnonDoor via a temporary PowerShell script and using LNK files to deliver the payload; the backdoor version also mirrored an MSIL variant. “This progression underscores Confucius’ adaptability and the growing sophistication of state-aligned malware campaigns in the region,” the FortiGuard Labs analysis notes.