Confucius is a cyber espionage group targeting military and government entities in South Asia.
Confucius is a cyber espionage group active since at least 2013, primarily targeting military personnel, government organizations, high-profile individuals, and business persons in South Asia. Their key TTPs include initial access via spearphishing attachments and links, deployment of WarzoneRAT malware, stealth through Mshta and Template Injection, and data exfiltration over C2 channels or to cloud storage. Defenders should focus on scrutinizing suspicious email attachments, monitoring Mshta execution, and inspecting unusual C2 web protocol traffic.
Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.
Monitor suspicious domain registrations or web hosting activity for creating or acquiring web services.
Monitor email traffic and user interaction for suspicious spearphishing attachments and links.
Monitor endpoint logs and user activity for suspicious Visual Basic scripts and malicious links.
Monitor endpoint configuration for Registry Run Keys and Startup Folder modifications.
Monitor endpoint logs and process creation events for suspicious Mshta and Template Injection activity.
Monitor endpoint logs and user activity for suspicious File and Directory Discovery and Local Storage Discovery activity.
Monitor endpoint logs and user activity for suspicious Automated Collection activity.
Monitor network traffic and endpoint logs for suspicious Web Protocols and Ingress Tool Transfer activity.
Monitor network traffic and endpoint logs for suspicious Exfiltration Over C2 Channel and Exfiltration to Cloud Storage activity.
Confucius uses spearphishing attachments and links to gain initial access.
Defenders should monitor Mshta execution and inspect for suspicious activity.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.