SloppyLemming Espionage Campaign Targets Pakistan, Bangladesh with BurrowShell Backdoor and Rust RAT

SloppyLemming (aka Outrider Tiger/Fishing Elephant) conducted a year-long espionage campaign against Pakistani and Bangladeshi government and critical infrastructure using spear‑phishing to deliver a BurrowShell backdoor and a Rust-based keylogger/RAT via DLL sideloading and ClickOnce manifests; the group scaled Cloudflare Workers for payload delivery and C2, leaked staged malware through misconfigured Workers, and utilized both custom implants and frameworks like Havoc, prompting specific detection and mitigation guidance.