Mysterious Elephant

Executive Summary

Mysterious Elephant (APT‑K‑47) is a rapidly evolving South‑Asian APT that emerged in 2023 and targets high‑value government, defense, infrastructure and commercial organizations across Asia‑Pacific. The group relies on spearphishing, zero‑day CVE exploitation and malicious document delivery to gain initial access, then deploys a diverse toolkit of RATs, web shells and custom backdoors for persistence, lateral movement and data exfiltration.

Goals & Targeting

Mysterious Elephant’s primary objective is strategic intelligence gathering on government agencies, defense establishments and critical infrastructure operators in targeted countries. By harvesting credentials, communications, documents and system metadata it enables geopolitical influence operations and potential sabotage or disruption scenarios. The selection of victims—often ministries of foreign affairs, police CMS systems and telecom backbones—indicates a focus on obtaining policy insight and facilitating subsequent clandestine actions. The group’s repeated use of culturally tailored spearphishing themes shows an intent to maximize engagement rates among specific populations. Their rapid exploitation of zero‑day vulnerabilities before disclosure indicates aggressive reconnaissance efforts designed to gain early, high‑privilege access. All indications point to a long‑term, state-backed mission aimed at enabling policy influence and operational decision advantage for the sponsoring nation rather than simply conducting conventional cybercrime.

Key Capabilities

• Spearfishing emails with culturally resonant themes (e.g., Hajj) using malicious CHM or RAR attachments
• Exploits zero‑day CVEs on privileged services such as mmc.exe, Ivanti Cloud Appliances and government mail gateways
• Deploys custom and open‑source RATs including ORPCBackdoor, AsyncShell, GOREVERSE, reverse_ssh, BabShell, MemLoader, and webshells (GOREshell, PHP)
• Establishes persistence via PowerShell‑created scheduled tasks, DLL hijacking, LNK/CHM/MSC file execution
• Uses Nimbo–C2 or similar frameworks for command‑and‑control with HTTP(S) beaconing that encodes victim details
• Exfiltrates data through encrypted bundles over HTTPS/TLS or DNS-over-HTTPS, sometimes using Let’s Encrypt certificates
• Harvests credentials from browsers and messaging apps (Chrome bookmarks, WhatsApp documents)
• Shares infrastructure and malware code with other India/CN state‑backed actors such as Origami Elephant, Confucius, SideWinder

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since its first appearance in 2023, Mysterious Elephant has demonstrated a steady escalation of capabilities and breadth. Initial campaigns focused on exploiting newly disclosed CVEs (e.g., CVE-2024-8963/8190) before public release, showing an aggressive approach to zero‑day exploitation. Overlap with other India/CN APTs reveals a shared supply chain where code, C2 infrastructure and even malware samples such as GOREVERSE are reused across campaigns. Victim profiles cover a wide range of sectors but consistently include high‑profile government bodies, defense ministries, telecommunication backbones and critical energy or transport infrastructures in CN, PK, IN, UA, KP, KR. These targets align with typical geopolitical objectives of state actors seeking policy influence or strategic advantage. Notable past operations include the distribution of ShadowPad to more than 70 global organizations, the deployment of GOREVERSE across government networks, and multiple spearphishing campaigns that leveraged Hajj‑themed content. The group's operational tempo shows rapid tool development, exploitation diversification (moving from CHM-based delivery to RAR+MSC payloads), and increased use of encrypted exfiltration channels. The evidence points to a long‑term commitment to espionage rather than opportunistic malware campaigns, with an emphasis on data acquisition from key governmental players in strategic regions.

IOC Patterns

• CHM files used as malicious payload carriers
• RAR archives embedding MSC executables that trigger mmc.exe
• Cmd shell execution via asynchronous programming (AsyncShell)
• Spearphishing attachments or malicious documents PowerShell scripts for execution, persistence and exfiltration
• Backdoors such as GOREVERSE, ORPCBackdoor, reverse_ssh, BabShell
• Webshells including GOREshell PHP
• ShadowPad samples in wide deployments
• CVE‑based exploitation of mmc.exe (GrimResource) and other public services
• HTTP(S) beacon traffic encoding victim details Scheduled task creation via PowerShell

Recommended Actions

• Apply timely patches for known CVEs (CVE-2024-8963, CVE-2024-8190, CVE-2024-43572, etc.) before public disclosure.
• Deploy detection rules for known backdoor signatures such as GOREVERSE, ORPCBackdoor, reverse_ssh and BabShell. Monitor outbound HTTP(S) beaconing patterns and anomalous PowerShell activity to detect Nimbo‑C2 or other C2 traffic. Block or quarantine RAR files containing embedded MSC executables; enforce policy to block execution of mmc.exe from untrusted sources. Implement advanced phishing filters, user education campaigns, and email sandboxing focused on spearphishing attachments. Detect and alert on creation of scheduled tasks via PowerShell or other persistence mechanisms. Inspect TLS/SSL traffic, including Certif‑ficate validation and DoH activity, to reveal Let’s Encrypt usage for data exfiltration. Deploy endpoint protection that detects known webshells (GOREshell), JavaScript injection, and credential harvesting scripts.
• suggested_tags
• AIT
• APT-K-47
• Mysterious Elephant
• Asynshell
• ORPCBackdoor
• PowerShell
• GoSerpent
• ScatterBrain
• GoreShell
• APT15
• Ke3Chang
• NylonTyphoon
• UNC5174
• TA397
• GOREVERSE
• ShadowPad
• CVE-2024-8963
• CVE-2024-8190
• CVE-2023-46747
• CVE-2024-1709
• Spearphishing
• ScheduledTaskPersistence
• CVEExploit
• PowerShellExecution
• GrimResource