South Asian hackers target Pakistani entities in new espionage campaign

Mysterious Elephant (APT-K-47), active since 2022 and likely South Asia–linked, has been observed targeting Pakistani entities in an espionage campaign that uses an upgraded Asyncshell backdoor delivered via phishing (encrypted ZIPs with password files) and decoy documents hosted on a Pakistani ministry site; the report links the group’s tooling and behavior to other India-linked state-sponsored actors and notes prior victimization across Pakistan, Bangladesh, and Turkey.