India-aligned threat group Dropping Elephant has launched a sophisticated multi-stage cyberattack targeting Pakistan’s defense sector using a Python-based remote access trojan disguised within an MSBuild dropper.

Idan Tarab has identified this advanced campaign that leverages fake defense-related phishing lures to compromise military research and development units and procurement facilities linked to Pakistan’s National Radio and Telecommunication Corporation.

The attack begins innocuously with a phishing email containing a malicious ZIP archive. Once downloaded, the archive includes an MSBuild project file that serves as the initial dropper, along with a decoy PDF designed to appear legitimate.

When executed, the dropper begins downloading multiple components to the Windows Tasks directory, establishing persistence via scheduled tasks with seemingly legitimate names such as KeyboardDrivers and MsEdgeDrivers.

Security researcher Idan Tarab noted that Dropping Elephant employed sophisticated obfuscation techniques throughout the infection chain, using UTF-reverse encryption to reconstruct strings and dynamic API resolution to avoid detection by security tools.

The group’s approach demonstrates significant technical maturity in weaponizing legitimate Windows utilities as part of their attack infrastructure.

The Stealth Python Persistence Mechanism

The operation’s centerpiece involves deploying a complete embedded Python runtime to the AppData directory, where a fake DLL file named python2_pycache_.dll actually contains marshalled Python bytecode rather than legitimate library code.

This payload executes via pythonw.exe, which runs without displaying a window, providing deep stealth against potential defenders.

The Python backdoor includes multiple modules, such as client, commands, remote_module, and base.py, enabling comprehensive system control and information gathering from compromised machines.

The malware maintains command-and-control communication through domains including nexnxky.info, upxvion.info, and soptr.info.

The identified code contains heavily obfuscated variable names and base64-encoded command structures, making manual analysis particularly challenging.

The group employed specific file paths and task scheduler entries that mimic legitimate Windows operations, allowing the backdoor to blend seamlessly into regular system activity while remaining dormant until receiving commands from attacker-controlled infrastructure.

This campaign underscores the persistent threat from advanced persistent threat groups targeting defense-critical infrastructure in South Asia.

Organizations should implement enhanced monitoring for suspicious MSBuild executions and for unusual Python runtime deployments in system directories, and maintain strict controls over phishing defense mechanisms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Dropping Elephant Hacker Group Attacks Defense Sector Using Python Backdoor via MSBuild Dropper appeared first on Cyber Security News.

In October 2025, a significant breach exposed the internal workings of APT35, also known as Charming Kitten, a cyber unit operating within Iran’s Islamic Revolutionary Guard Corps Intelligence Organization.

Thousands of leaked documents revealed the group’s systematic approach to targeting governments and businesses across the Middle East and Asia.

The exposure included performance reports, technical guides, and operational records that paint a clear picture of how this state-sponsored group conducts cyber espionage on a large scale.

The leaked materials show that APT35 operates like a traditional military organization rather than a casual hacker collective.

DomainTools security analysts identified that the group maintains detailed performance tracking systems, where operators report their work hours, completed tasks, and success rates to supervisors who then compile comprehensive campaign summaries.

This bureaucratic structure reveals operators working from a centralized facility with badge-in entry systems, fixed work schedules, and formal oversight mechanisms.

The organization includes specialized teams focused on exploit development, credential harvesting, phishing operations, and real-time mailbox monitoring to gather human intelligence. The attack methods documented in the leaked files are methodical and highly organized.

DomainTools security researchers noted that APT35 primarily targets Microsoft Exchange servers through ProxyShell exploitation chains combined with Autodiscover and EWS services to extract Global Address Lists containing employee contact information.

These contact lists become the foundation for targeted phishing campaigns that harvest credentials. Once initial access is gained, the group uses custom-developed tools to establish persistent access and steal additional credentials from computer memory using techniques similar to Mimikatz.

The stolen information enables the attackers to move laterally through networks and maintain long-term access.

The geographic scope of the campaign extends across multiple critical regions. Targeted entities include government ministries, telecommunications companies, customs agencies, and energy firms in Turkey, Lebanon, Kuwait, Saudi Arabia, South Korea, and Iran.

The leaked documents contain annotated target lists with notes indicating which attacks succeeded and which failed, along with webshell paths used to maintain access.

The operational focus reveals strategic intelligence collection priorities aligned with Iranian government objectives rather than random opportunistic attacks.

Access to diplomatic communications, telecom infrastructure, and critical energy sectors provides Tehran with valuable information for geopolitical negotiations and threat assessment.

Exchange Exploitation and Credential Harvesting Pipeline

The technical infrastructure supporting APT35’s operations demonstrates sophisticated understanding of enterprise email systems.

The group weaponizes Exchange vulnerabilities through a coordinated exploitation sequence that begins with reconnaissance scanning to identify vulnerable servers. Once suitable targets are identified, operators deploy webshells disguised as legitimate system files to establish remote command execution capabilities.

These webshells, commonly named with the m0s.* pattern, provide interactive command shells that operators access through specially crafted HTTP headers.

The Python-based client tools used by operators encode commands within Accept-Language headers and use a static token for authentication, creating a covert communication channel that blends with legitimate network traffic.

Following initial access, the group extracts the Global Address List from Exchange servers, converting email contact information into structured data for subsequent phishing operations.

Harvested credentials are immediately validated and reused across other systems in the target network.

The leaked documents describe automated scripts that validate shells and extract mailbox contents without human intervention, demonstrating capability development maturity.

The entire process follows standardized templates documented in internal playbooks, with success metrics recorded in monthly performance reports.

This systematic approach to Exchange compromise, credential extraction, and phishing integration illustrates how APT35 transforms technical vulnerabilities into sustainable intelligence collection operations measured by quantifiable output rather than random opportunity.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post APT35 Hacker Groups Internal Documents Leak Exposes their Targets and Attack Methods appeared first on Cyber Security News.

Large language models like GPT-3.5-Turbo and GPT-4 are transforming how we work, but they are also opening doors for cybercriminals to create a new generation of malware.

Researchers have demonstrated that these advanced AI tools can be manipulated to generate malicious code, fundamentally changing how attackers operate.

Unlike traditional malware that relies on hardcoded instructions within the program itself, this new approach uses AI to create instructions on the fly, making detection far more challenging for security teams.

The threat landscape has shifted significantly. Cybercriminals can now use simple tricks called prompt injection to bypass the safety measures built into these AI models.

By framing requests in specific ways, such as pretending to be a penetration testing tool, attackers convince the models to generate code for dangerous operations like injecting malware into system processes and disabling antivirus software.

This means future malware could contain almost no detectable code within the binary itself, instead relying on the AI to generate new instructions each time it runs.

Netskope security analysts identified and documented this emerging threat after conducting comprehensive testing of both GPT-3.5-Turbo and GPT-4.

Their research revealed that while these language models can indeed be coerced into generating malicious code, there are still significant obstacles preventing fully functional autonomous attacks.

The security team systematically tested whether the generated code actually works in real environments, uncovering critical limitations that currently protect systems from widespread exploitation.

Defense Evasion Mechanisms and Code Generation Reliability

The core challenge for attackers isn’t simply generating malicious code anymore, it’s ensuring that code actually functions reliably on victim machines.

Netskope researchers specifically examined defense evasion techniques, testing whether GPT models could create scripts to detect virtual environments and sandbox systems where malware analysis typically occurs.

These scripts are essential because they help malware determine whether it’s running in a controlled testing environment or on a real user’s computer.

When researchers asked GPT-3.5-Turbo to generate a Python script for process injection and AV termination, the model complied immediately and provided working code.

However, GPT-4 initially refused this request because its safety guards recognized the harmful intent. The breakthrough came when researchers used role-based prompt injection, essentially asking GPT-4 to assume the role of a defensive security tool.

Under this framing, the model generated functional code for executing injection and termination commands.

The practical implication is clear: attackers no longer need to write these dangerous functions manually or risk detection by hiding them in compiled binaries. They can simply request the AI generate them during runtime.

However, when Netskope researchers tested whether GPT models could create reliable virtualization detection scripts, the results were disappointing for attackers.

The AI-generated code performed poorly across different environments, including VMware Workstation, AWS Workspace VDI, and physical systems. Scripts either crashed or returned incorrect results, failing to meet the strict requirements for operational malware.

This fundamental weakness currently limits the viability of fully autonomous LLM-powered attacks. As AI models continue improving, particularly with emerging versions like GPT-5, these reliability issues will likely diminish, shifting the primary obstacle from code functionality to overcoming increasingly sophisticated safety guardrails within AI systems.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post LLMs Tools Like GPT-3.5-Turbo and GPT-4 Fuels the Development of Fully Autonomous Malware appeared first on Cyber Security News.

A dangerous malware campaign has surfaced targeting cryptocurrency users through a deceptive Python package hosted on the PyPI repository.

The threat actors disguised their malicious code within a fake spell-checking tool, mimicking the legitimate pyspellchecker package that boasts over 18 million downloads.

This supply chain attack represents an evolving threat landscape where attackers exploit trusted software repositories to distribute remote access trojans and credential harvesting tools to unsuspecting developers worldwide.

The malicious package, designed to steal sensitive cryptocurrency information, employs sophisticated obfuscation techniques and multiple encryption layers to evade detection.

HelixGuard security researchers identified that the command-and-control infrastructure linked to this operation matches servers previously used in elaborate social engineering campaigns impersonating recruiters.

This connection reveals a coordinated attack strategy in which threat actors have expanded from direct social engineering to automated distribution via open-source platforms, significantly amplifying their reach and effectiveness within the development community.

The package has already been downloaded more than 950 times since its deployment. HelixGuard security analysts identified that the malware operates through a staged delivery mechanism, with each phase designed to maintain stealth while progressively gaining deeper control over compromised systems.

The attackers maintain a particularly troubling focus on extracting cryptocurrency information, reflecting the high financial incentives driving modern malware development and the continued targeting of digital asset holders regardless of their technical expertise.

Understanding the Multi-Stage Infection Process

The infection mechanism reveals meticulous engineering aimed at bypassing security detection systems at each step.

When users install and execute the malicious package, the malware first triggers through a Base64-encoded hidden index file called ma_IN.index.

This encoded payload gets decoded and executed directly using Python’s exec() function, a technique that avoids writing suspicious code to disk.

The initial payload connects to an attacker-controlled command and control server at dothebest.store, where it downloads the second-stage malicious code.

The second-stage payload is the full remote access trojan, capable of executing arbitrary Python commands remotely.

This backdoor uses XOR encryption for network communications and custom protocol formats to conceal its activities from network monitoring tools.

The malware suppresses exceptions throughout execution, preventing error messages that might alert security tools or the user.

Once activated, the backdoor enables complete remote control over the victim’s computer, allowing attackers to harvest cryptocurrency wallets, authentication credentials, and other sensitive data stored on the system.

Security researchers recommend users immediately review their installed Python packages, update their dependency lists, and remove any suspicious packages.

Organizations should implement strict dependency scanning in their development pipelines and monitor for connections to the identified command and control addresses at dothebest.store.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leverage Malicious PyPI Package to Attack Users and Steal Cryptocurrency Details appeared first on Cyber Security News.