Fishing Elephant — APT Profile
Fishing Elephant primarily targets victims in Bangladesh and Pakistan. They rely on consistent TTPs, including payload and communication patterns, while occasionally incorporating new techniques such as geo-fencing and hiding executables within certificate files. Their tool of choice is AresRAT, which they deliver through platforms like Heroku and Dropbox. Recently, they have shifted their focus to government and diplomatic entities in Turkey, Pakistan, Bangladesh, Ukraine, and China.Also tracked as
Outrider Tiger, SloppyLemming
Tools & malware
- Ares RAT RAT
- BurrowShell Backdoor
- CloudPhish Credential harvesting tool
- Cobalt Strike Adversary emulation framework
- Havoc Adversary emulation / C2 framework
- NekroWire RAT
Vendor research
- Unraveling SloppyLemming’s operations across South Asia Cloudflare (CloudForce One)
- SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh Arctic Wolf
- SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains The Hacker News
Countries linked to this actor
- Sri Lanka targets
- Bangladesh targets