Operation Celestial Force employs mobile and desktop malware to target Indian entities

Cisco Talos discloses "Operation Celestial Force," a long-running (since at least 2018) espionage campaign attributed to a Pakistani-linked cluster called "Cosmic Leopard" that uses Windows and Android implants (GravityRAT), an Electron-based loader (HeavyLift), and a multi-panel admin tool (GravityAdmin) to target Indian government, defense and related technology entities via maldocs, spearphishing and social-engineering; the report provides technical analysis, campaign code names, IOCs, and mitigation guidance.