'Mysterious Elephant' Moves Beyond Recycled Malware

Kaspersky researchers, tracking the group as “Mysterious Elephant,” say a cyber-espionage operation that initially relied on code from other outfits has evolved into a sophisticated campaign using its own custom tools to target government and diplomatic entities in South Asia since early 2025, according to Kaspersky.

The campaign has focused on entities in Pakistan, Bangladesh, Sri Lanka and, to a lesser extent, Afghanistan and Nepal, with highly customised spear-phishing emails and decoy documents used to gain initial access.

Once inside, the group deploys a multistage toolkit that blends open source and bespoke code, including a C++ reverse shell named BabShell and in-memory loaders such as MemLoader HidenDesk and MemLoader Edge to install backdoors like VRAT, while also exfiltrating documents, images and other data from apps including WhatsApp.

The operation emphasises data theft from WhatsApp and related files, aided by tools that scan for valuable file types and upload them to the attackers’ C2 servers, aided by wildcard DNS to create unique domains for each victim. Kasperksy’s researchers note the group’s tool set shows advances in its capabilities, even as no specific nation-state link is asserted.