SloppyLemming Cyber Espionage Campaign Targets South Asian Governments and Critical Infrastructure A recent report by cybersecurity firm Arctic Wolf has linked the threat group SloppyLemming (also tracked as Outrider Tiger and Fishing Elephant) to a large-scale malware campaign targeting government agencies and critical infrastructure operators in Pakistan and Bangladesh between January 2025 and January 2026. The operation employed dual malware chains to conduct espionage and data theft, marking a significant evolution in the group’s tactics. ### Attack Methods and Malware Payloads SloppyLemming deployed two distinct infection vectors: 1. BurrowShell Backdoor – Delivered via spear-phishing emails with malicious PDF attachments, this payload granted attackers full remote access, enabling file system control, screenshot capture, command execution, and network tunneling via a SOCKS proxy. Malicious traffic was disguised as legitimate Windows Update communications, using RC4 encryption to evade detection. 2. Rust-Based Keylogger – Embedded in macro-enabled Excel documents, this chain dropped a Rust-written keylogger alongside reconnaissance tools capable of port scanning and network enumeration, allowing attackers to gather sensitive data from compromised environments. ### Sophisticated Delivery and Infrastructure The campaign leveraged spear-phishing emails with booby-trapped attachments, including ClickOnce manifests that executed DLL sideloading loading malicious code under the guise of trusted Microsoft .NET binaries. Additionally, SloppyLemming abused Cloudflare Workers domains (112 identified in the past year) to relay command-and-control (C2) traffic, complicating attribution and takedown efforts. ### Broader Threat Landscape Active since at least 2022, SloppyLemming has a history of targeting government, law enforcement, energy, and telecommunications sectors across South and East Asia, including Sri Lanka, China, and Nepal. While the group is considered moderately capable, its use of custom malware (Ares RAT, WarHawk, Cloud Phish) and cloud-based exfiltration underscores the growing sophistication of cyber espionage in the region. Despite some operational security missteps, the dual-payload approach and abuse of legitimate cloud services highlight the persistent threat to regional governments and critical infrastructure.