SloppyLemming Cyber Espionage Campaign Strikes Southeast Asia Using BurrowShell and Rust RAT

Between January 2025 and January 2026, Arctic Wolf observed a significant cyber espionage campaign attributed to the India-linked threat actor known as SloppyLemming, also identified as Outrider Tiger and Fishing Elephant.

This campaign primarily targeted government institutions and critical infrastructure operators across Pakistan and Bangladesh to steal sensitive data and maintain persistent access to key systems.

This report reveals previously unreported tools, infrastructure, and targeted sectors, offering new insights into the group’s evolving tactics and increasing operational scale.

Multi-Stage Attack Chain Unveiled

The attack employed two primary methods of execution, both initiated through spear-phishing. The first chain began with a deceptive PDF document that redirected victims to a ClickOnce application manifest.

This manifest led to the execution of a DLL sideloading package, composed of a legitimate Microsoft .NET runtime executable (NGenTask.exe) and a malicious loader (mscorsvc.dll).

The loader decrypted and executed a custom shellcode implant, BurrowShell, which gave attackers full control over the compromised systems.

BurrowShell enables a threat actor to manipulate files, take screenshots, run commands remotely, and set up SOCKS proxies to gain further network access.

This implant hides its command-and-control (C2) communications as Windows Update traffic and uses RC4 encryption to protect its payload.

SloppyLemming has significantly expanded its infrastructure during this campaign. Arctic Wolf identified 112 Cloudflare Workers domains used for payload delivery and C2 communication between January 2025 and January 2026.

This marked a sharp increase from the 13 Workers domains observed in September 2024, reflecting a dramatic rise in operational tempo, particularly in mid-2025.

The infrastructure mimicked legitimate Pakistani and Bangladeshi government websites, including the Pakistan Nuclear Regulatory Authority (PNRA) and the Dhaka Electric Supply Company (DESCO).

These fake domains allowed the attackers to blend in with legitimate web traffic, making it harder to detect their activities.

Interestingly, several domains were discovered with open directory misconfigurations that unintentionally exposed staged malware, including Havoc C2 framework loaders.

Key Targets and Victimology

The campaign’s victims align with the group’s known targeting preferences, focusing on critical sectors in Pakistan and Bangladesh.

The group’s activities primarily targeted nuclear regulatory bodies, defense organizations (e.g., the Pakistan Navy), telecommunications providers, and energy utilities, including the Power Grid Company of Bangladesh (PGCB) and Bangladesh Bank.

This suggests a geopolitical motivation behind the campaign, as these entities play pivotal roles in the region’s infrastructure and security.

According to Arctic Wolf research, SloppyLemming’s cyber espionage campaign illustrates the growing sophistication of state-aligned threat actors in South Asia.

By leveraging advanced tools such as BurrowShell and a Rust-based keylogger and using stealthy infrastructure such as Cloudflare Workers, the group has demonstrated a deep understanding of security evasion techniques.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.