The risk actor often called Confucius has been attributed to a brand new phishing marketing campaign that has focused Pakistan with malware households like WooperStealer and Anondoor.
“Over the previous decade, Confucius has repeatedly focused authorities businesses, navy organizations, protection contractors, and significant industries — particularly in Pakistan – utilizing spear-phishing and malicious paperwork as preliminary entry vectors,” Fortinet FortiGuard Labs researcher Cara Lin stated.
Confucius is a long-running hacking group that is believed to have been energetic since 2013 and working throughout South Asia. Current campaigns undertaken by the risk actor have employed a Python-based backdoor referred to as Anondoor, signaling an evolution of the group’s tradecraft and its technical agility.
One of many assault chains documented by Fortinet focused customers in Pakistan someday in December 2024, tricking recipients into opening a .PPSX file, which then triggers the supply of WooperStealer utilizing DLL side-loading methods.
A subsequent assault wave noticed in March 2025 has been discovered to make use of Home windows shortcut (.LNK) recordsdata to unleash the malicious WooperStealer DLL, once more launched utilizing DLL side-loading, to steal delicate information from compromised hosts.
One other .LNK file noticed in August 2025 additionally leveraged related ways to sideload a rogue DLL, solely this time the DLL paves the best way for Anondoor, a Python implant that is designed to exfiltrate gadget info to an exterior server and await additional duties to execute instructions, take screenshots, enumerate recordsdata and directories, and dump passwords from Google Chrome.
It is value noting that the risk actor’s use of Anondoor was documented in July 2025 by Seebug’s KnownSec 404 Staff.
“The group has demonstrated robust adaptability, layering obfuscation methods to evade detection and tailoring its toolset to align with shifting intelligence-gathering priorities,” Fortinet stated. “Its current campaigns not solely illustrate Confucius’ persistence but in addition its skill to pivot quickly between methods, infrastructure, and malware households to keep up operational effectiveness.”
The disclosure comes as K7 Safety Labs detailed an an infection sequence related to the Patchwork group that commences with a malicious macro that is designed to obtain a .LNK file containing PowerShell code accountable for downloading further payloads and leveraging DLL side-loading to launch the first malware whereas concurrently displaying a decoy PDF doc.
The ultimate payload, for its half, establishes contact with the risk actor’s command-and-control (C2) server, gathers system info, and retrieves an encoded instruction that is subsequently decrypted for execution utilizing cmd.exe. It is also outfitted to take screenshots, add recordsdata from the machine, and obtain recordsdata from a distant URL and save them regionally in a brief listing.
“The malware waits for a configurable interval and retries sending the information as much as 20 occasions, monitoring failures to make sure persistent and stealthy information exfiltration with out alerting the consumer or safety techniques,” the corporate stated.
