SloppyLemming is an advanced threat actor using cloud services for credential harvesting and cyber espionage.
SloppyLemming is an advanced threat actor leveraging multiple cloud service providers for credential harvesting, malware delivery, and C2. It targets government, law enforcement, energy, telecommunications, and technology entities primarily in Pakistan, Sri Lanka, Bangladesh, and China. Defenders should focus on monitoring anomalous cloud service usage, especially for credential harvesting attempts and suspicious authentication activities.
SloppyLemming is an advanced actor that uses multiple cloud service providers to facilitate different aspects of their activities, such as credential harvesting, malware delivery and command and control (C2). This actor conducts extensive operations targeting Pakistani, Sri Lanka, Bangladesh, and China. Industries targeted include government, law enforcement, energy, telecommunications, and technology entitie
SloppyLemming leverages multiple cloud service providers for credential harvesting, malware delivery, and C2.
It primarily targets government, law enforcement, energy, telecommunications, and technology entities in Pakistan, Sri Lanka, Bangladesh, and China.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.