Mysterious Elephant (APT-K-47) Targets South Asian Government Networks With Advanced Custom Malware and Supply Chain Attacks

Executive Summary

Publication Date: 2025

The threat landscape in South Asia has been significantly altered by the emergence and evolution of Mysterious Elephant (also known as APT-K-47), an advanced persistent threat group first detailed by Kaspersky in 2023. This group has rapidly moved beyond the use of recycled malware, developing custom, modular toolsets and advanced attack chains that primarily target government and diplomatic entities in Pakistan, Bangladesh, and Turkey. The following report provides a comprehensive analysis of Mysterious Elephant’s technical innovations, operational tactics, and the broader security implications for organizations worldwide.

Introduction

Mysterious Elephant represents a new breed of APT actors, characterized by their ability to innovate and adapt in the face of evolving security controls. Their campaigns are marked by sophisticated spear-phishing, exploitation of supply chain vulnerabilities, and a focus on long-term espionage. This report examines the group’s technical capabilities, the risks posed to organizations, and the necessary security controls to mitigate these threats.

Technical Analysis and Core Functionality

The core of Mysterious Elephant’s arsenal includes custom malware such as ORPCBackdoor and Asyncshell. ORPCBackdoor utilizes an RPC-based command-and-control (C2) channel over ncacn_ip_tcp, employs DLL hijacking with version.dll, and achieves persistence through scheduled tasks. Its capabilities extend to reconnaissance, command execution, and file exfiltration. Asyncshell is a lightweight command-line C2 agent that has undergone several iterations since 2023, now supporting HTTPS for C2 communications and variable C2 addresses, which complicates detection and blocking efforts.

The group’s initial access techniques rely on spear-phishing with password-protected ZIP archives and malicious RTF or CHM files. They exploit vulnerabilities such as CVE-2023-38831 in WinRAR, and use decoy files hosted on legitimate government infrastructure to enhance the credibility of their lures. Persistence is maintained through scheduled tasks and DLL hijacking, while C2 infrastructure is frequently updated to evade network-based defenses.

Key Innovations and Differentiators

Mysterious Elephant has distinguished itself by moving beyond recycled malware, developing entirely new malware families and updating its infrastructure to minimize detection. The evolution of Asyncshell—from fixed to variable C2 addresses and the adoption of HTTPS—demonstrates the group’s commitment to operational security and adaptability. Their use of disguised service requests to control shell server addresses further complicates attribution and response.

The group’s campaigns are not limited to technical innovation; they also leverage advanced social engineering, using Hajj-themed lures and other contextually relevant decoys to increase the likelihood of successful compromise. By hosting malicious documents on legitimate infrastructure, they further reduce the chances of early detection.

Security Implications and Potential Risks

The primary objective of Mysterious Elephant is long-term espionage. Their operations provide persistent access to victim environments, enabling ongoing system data exfiltration and intelligence collection aligned with strategic state interests. The exploitation of supply chain vulnerabilities, such as those seen in the broader APT landscape with incidents like the XZ Utils backdoor, highlights the increased risk to organizations dependent on third-party software and services.

Organizations face heightened exposure to risks stemming from the group’s ability to exploit both technical vulnerabilities and human factors. The use of legitimate infrastructure for hosting decoy documents and leveraging known software vulnerabilities increases the attack surface and complicates incident response.

Supply Chain and Third-Party Dependencies

Mysterious Elephant’s campaigns underscore the critical importance of supply chain security. By exploiting vulnerabilities in widely used software and leveraging legitimate third-party infrastructure, the group demonstrates how attackers can bypass traditional perimeter defenses. This reality necessitates a renewed focus on third-party risk management, continuous monitoring, and the implementation of robust vendor security practices.

Security Controls and Compliance Requirements

To mitigate the risks posed by Mysterious Elephant, organizations should prioritize patching vulnerable software such as WinRAR, blocking risky file formats like CHM and RTF at email gateways, and enabling attachment sandboxing and content disarm/reconstruction. Implementing endpoint detection and response (EDR) rules to detect DLL hijacking attempts and abnormal scheduled task creation is essential. These controls, combined with user awareness training and incident response playbooks, form the foundation of an effective defense strategy.

Industry Adoption and Integration Challenges

The tactics employed by Mysterious Elephant highlight the challenges organizations face in defending against APTs that utilize legitimate infrastructure, advanced social engineering, and rapidly evolving malware. Integrating advanced threat detection, user training, and incident response capabilities is essential for effective defense. The group’s activities also emphasize the need for vendors to maintain rigorous security controls, conduct regular code audits, and ensure transparent incident response processes.

Technical Specifications and Requirements

Mysterious Elephant’s toolset includes custom malware such as ORPCBackdoor (RPC-based C2) and Asyncshell (cmd/PowerShell execution, HTTPS C2). Initial access is achieved through spear-phishing with password-protected ZIPs and malicious RTF/CHM files, exploiting vulnerabilities like CVE-2023-38831 in WinRAR. Persistence mechanisms include scheduled tasks and DLL hijacking, while C2 infrastructure is characterized by variable addresses, HTTPS, and disguised service requests.

Cyber Perspective

From a cyber defense perspective, the evolution of Mysterious Elephant signals a shift toward more sophisticated, modular, and evasive APT toolsets. Attackers are increasingly leveraging supply chain weaknesses, legitimate infrastructure, and advanced social engineering to bypass traditional defenses. For defenders, this means that reliance on signature-based detection is no longer sufficient. Organizations must adopt layered security architectures, continuous monitoring, and proactive threat hunting. The group’s focus on long-term access and intelligence collection raises the stakes for organizations in sensitive sectors, making third-party risk management and supply chain security critical priorities. As a result, the market is likely to see increased demand for advanced EDR, threat intelligence, and TPRM solutions.

About Rescana

Rescana empowers organizations to address the risks posed by advanced threats like Mysterious Elephant with our industry-leading Third-Party Risk Management (TPRM) platform. Our solution enables continuous monitoring of your supply chain, assessment of vendor security practices, and ensures compliance with the latest security standards. With Rescana, you gain actionable insights and automated workflows to identify, prioritize, and mitigate third-party risks—empowering your security team to stay ahead of evolving threats.

We are happy to answer any questions at ops@rescana.com.