Over the last 12 months, Arctic Wolf has been tracking an extensive cyber espionage campaign conducted by SloppyLemming, an India-nexus threat actor, targeting government entities and critical infrastructure operators in Pakistan and Bangladesh.

ArcticWolf's platform is a central hub for cybersecurity professionals, offering insights into managed detection and response (MDR), threat intelligence, and security operations. Through articles, reports, and webinars, ArcticWolf offers insights into detecting and responding to cybersecurity threats effectively. Security analysts can learn about threat hunting, incident response strategies, and security best practices to protect organizations from cyberattacks.

Arctic Wolf

Arctic Wolf Labs has documented a year-long cyber espionage campaign attributed with moderate confidence to SloppyLemming (also known as Outrider Tiger/Fishing Elephant), a suspected India-aligned threat actor. The campaign targeted government, defense, nuclear, energy, and telecom sectors in Pakistan and Bangladesh using two attack chains: PDF lures triggering ClickOnce manifests that deploy a custom x64 shellcode backdoor called BurrowShell via DLL sideloading, and macro-laden Excel files delivering a Rust-based keylogger. BurrowShell supports 15 commands including file operations, screenshots, shell execution, and SOCKS proxy tunneling, masquerading C2 traffic as Windows Update communications. The Rust keylogger adds port scanning and network enumeration. Infrastructure analysis identified 112 Cloudflare Workers domains impersonating Pakistani and Bangladeshi government entities, an 8x expansion from prior reporting. Three domains had open directory misconfigurations exposing malware components including Havoc C2 framework artifacts. Peak infrastructure registration occurred in July 2025 with 42 new domains. The report includes full IOCs, detection recommendations, and mitigation guidance.

SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh