Mysterious Elephant APT Breach: Hackers Infiltrate Organization to Steal Sensitive Data

According to Kaspersky Lab’s Global Research and Analysis Team (GReAT), the Mysterious Elephant APT group has conducted a campaign of intrusions against government and foreign policy agencies across the Asia-Pacific region, active since early 2025. The operation relies on custom-built malware modules and modified open-source utilities to target and siphon off documents, images and archives transmitted via WhatsApp.

First identified in 2023, the group continually refines its tactics to avoid detection and exfiltrate highly sensitive data, incorporating code from Origami Elephant, Confucius and SideWinder. The campaign uses spear phishing as the primary entry vector, with highly personalised emails and attachments designed to install malicious payloads.

Once inside, BabShell exfiltration and a MemLoader duo are used, with PowerShell scripts abusing curl and certutil to download next-stage payloads; data exfiltration focuses heavily on WhatsApp artifacts. The group’s victims include government and foreign affairs agencies in Pakistan, Bangladesh, Sri Lanka, Afghanistan and Nepal, with infrastructure that employs wildcard DNS and multiple VPS providers to complicate tracking.