“Nomad Leopard” Spotted in the Wild: Cyber Espionage Campaign Targets Afghan Government

A new cyber espionage campaign called Nomad Leopard has been uncovered targeting Afghanistan’s administration, with researchers describing the threat as regionally focused and of low-to-moderate sophistication. According to SEQRITE Labs APT Team, the group uses social engineering with official-looking documents in phishing emails, where attachments are ISO files containing a malicious LNK that, when opened, triggers a hidden payload masquerading as a harmless image.

The campaign relies on GitHub to host and distribute the malicious files, blending traffic with normal network activity. Researchers traced the operators to a GitHub user named “afghanking777000” and linked this persona to other accounts across social media sites, including Pinterest and Dailymotion, sometimes with locations noted in Pakistan.

The attackers’ OPSEC blunders—such as reusing online personas across platforms—led investigators to speculate that Nomad Leopard may be operated by an individual or small cluster rather than a large state-backed group. The analysis notes that the threat could be preparing for future campaigns and may target other countries beyond Afghanistan.