SloppyLemming Espionage Campaign Uses BurrowShell Backdoor and Rust RAT to Hit Pakistan and Bangladesh Targets

- SloppyLemming conducted a year-long espionage campaign (Jan 2025–Jan 2026) targeting government, defense, nuclear oversight, utilities, and financial organizations in Pakistan and Bangladesh using two spear-phishing paths: a PDF lure that led to a ClickOnce chain deploying an in-memory backdoor (BurrowShell) via DLL search-order hijacking, and macro-enabled Excel spreadsheets that delivered a Rust-based RAT with keylogging; researchers observed large-scale supporting infrastructure (112 Cloudflare Workers domains impersonating government entities) and provided IOCs and mitigations.