Confucius APT Expands Cyber Espionage Campaigns Against Pakistan with New Malware Tools The threat group Confucius, active since at least 2013, has launched a renewed phishing campaign targeting Pakistan, deploying advanced malware families including WooperStealer and the Python-based backdoor Anondoor. According to Fortinet FortiGuard Labs, the group has historically focused on government agencies, military organizations, defense contractors, and critical industries in South Asia, using spear-phishing and malicious documents as initial attack vectors. Recent activity reveals an evolution in Confucius’ tactics. In December 2024, the group used a malicious .PPSX file to deliver WooperStealer via DLL side-loading, a technique also employed in a March 2025 campaign that leveraged Windows shortcut (.LNK) files to deploy the same malware. By August 2025, Confucius had shifted to Anondoor, a Python-based implant capable of exfiltrating device data, executing commands, capturing screenshots, enumerating files, and stealing Chrome passwords. The group’s transition from information stealers to backdoors suggests a strategic pivot toward long-term surveillance and persistence. Fortinet notes that Confucius has demonstrated strong adaptability, employing obfuscation techniques and rapidly adjusting its infrastructure and malware to evade detection and align with intelligence-gathering objectives. Separately, K7 Security Labs reported on a Patchwork APT campaign involving malicious macros that download .LNK files containing PowerShell code. These files initiate DLL side-loading to execute malware while displaying a decoy PDF, ultimately establishing command-and-control (C2) communication to exfiltrate system data, capture screenshots, and transfer files all while employing stealth mechanisms to avoid detection.