File · Mysterious Elephant · Unknown · misp-galaxy · refreshed 2026-10-06
Mysterious Elephant
sigil · no ATT&CK coverage stated
Analyst brief
misp-galaxyMysterious Elephant is an APT group active since 2023 that primarily targets government and foreign affairs entities across South Asia, especially Pakistan, Bangladesh, Sri Lanka, Nepal, and Afghanistan. In its early-2025 campaign it shifted toward spear-phishing and custom/customized tools—including the BabShell reverse shell and MemLoader HidenDesk/Edge loaders—to deploy RATs like Remcos and VRat, while also using WhatsApp-specific exfiltration tools to steal shared documents, images, and archives. The group shares code and infrastructure with other APT clusters (Origami Elephant, Confucius, SideWinder), reflecting ongoing tool reuse and collaboration among South Asian threat actors.
CVEs Mysterious Elephant is cited as exploiting
none on KEV- CVE-2017-118822026-10-17
“Initial access is typically achieved through spear-phishing emails carrying weaponized Office documents exploiting CVE-2017-11882.”
cited as exploiting · named nearby · source: anomali.com ↗ · 2026-10-17
“The actor’s early attack chains featured distinctive elements, such as remote template injections and exploitation of CVE-2017-11882 , followed by the use of a downloader called “Vtyrei””
cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
2 sourcesTrack Mysterious Elephant on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.