SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh
Essential information
- Published
- 03/03/2026 11:11
- Modified
- 03/03/2026 17:14
- Tags
- 2026-03-03 bangladesh burrowshell clickonce cloudflare workers cyber espionage dll sideloading geopolitical conflict havoc pakistan rust rat
- Related entities
- 19 observables, 1 intrusion sets (apt), 19 techniques (mitre), 2 malware, 8 others
Description
An extensive cyber espionage campaign conducted by SloppyLemming, an India-nexus threat actor, targeted government entities and critical infrastructure in Pakistan and Bangladesh from January 2025 to January 2026. The campaign used two attack vectors: PDF lures with ClickOnce execution chains and macro-enabled Excel documents. It deployed a custom x64 shellcode implant named BurrowShell and a Rust-based keylogger. The attackers extensively abused Cloudflare Workers for C2 and payload delivery, registering 112 domains impersonating government entities. The campaign focused on nuclear, defense, telecommunications, energy, and financial sectors, aligning with regional strategic competition in South Asia.