Elephant APT Group Targets Defense Industry Using VLC Player and Encrypted Shellcode

A newly uncovered cyber-espionage campaign is being attributed to the “Dropping Elephant” APT group (also known as Patchwork or Quilted Tiger), allegedly of Indian origin.

The ongoing operation zeroes in on a prominent Turkish manufacturer of precision-guided missile systems, leveraging a sophisticated, multi-phase infection chain that underscores the evolution of the group’s capabilities.

From Social Engineering to Stealthy Code Execution

The latest offensive begins with convincingly crafted spear-phishing emails sent to employees in the Turkish defense sector.

According to Arctic Wolf Report, these emails lure recipients with fake invitations to the “Unmanned Vehicle Systems Conference 2025 in Istanbul,” and include a malicious LNK file attachment named Unmanned_Vehicle_Systems_Conference_2025_In_Istanbul.lnk.

Once executed, the LNK file launches a PowerShell script that silently pulls a series of staged payloads from a newly registered, adversary-controlled domain, expouav[.]org, designed to mimic the legitimate conference website.

In tandem, a PDF imitation of the conference program is displayed to the target, serving as a visual distraction while the malware deploys in the background.

The infection chain proceeds through five distinct stages, ultimately delivering a custom Remote Access Trojan (RAT).

Notably, this iteration demonstrates an architectural shift from x64 DLL-based payloads previously seen in late 2024, to more compact x86 PE executables featuring optimized command-parsing logic and reduced reliance on external libraries.

Task Scheduler Abused for Evasion

Key to the campaign’s effective stealth is the use of legitimate binaries in a classic defense evasion tactic known as DLL side-loading.

The attacker’s script downloads a legitimate copy of VLC Media Player and a malicious DLL disguised as libvlc.dll.

The VLC executable, launched via a scheduled task (itself invoked using a legitimate copy of Microsoft’s Task Scheduler tool), sideloads the malicious DLL which decrypts an encrypted shellcode blob and launches the final payload entirely in memory.

The decrypted shellcode collects victim machine information, takes screenshots, and establishes encrypted communications with a second attacker-controlled server, roseserve[.]org, for command-and-control (C2).

This C2 infrastructure is also disguised, masquerading as sites associated with Türkiye’s government-endorsed Pardus Linux project and the country’s Anadolu Agency news provider, reflecting the attackers’ focus on blending into local digital environments.

The campaign’s timeline aligns with rising defense collaboration between Türkiye and Pakistan and renewed India-Pakistan military tensions, reinforcing hypotheses of politically motivated targeting.

The infrastructure was methodically staged throughout June and July 2025, preceding a major UAV conference in Istanbul.

The attackers’ investment in creating near-identical website lures and technical adaptations, including a refined C2 protocol using the strtok C function, evidence increased operational security and a focus on strategic, high-value intelligence.

This attack exemplifies the constantly evolving threat posed by APT groups leveraging social engineering, living-off-the-land techniques, and highly targeted lures.

Organizations, especially those operating in the defense sector, should bolster user awareness training, adopt advanced EDR solutions, and enforce the principle of least privilege to mitigate such threats.

Regular patching, robust email security, and proactive threat intelligence integration remain essential to defending against sophisticated attackers like Dropping Elephant.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates