'Mysterious Elephant' Moves Beyond Recycled Malware

Mysterious Elephant is an advanced cyberespionage group active in South Asia that has progressed from reusing others' malware to deploying a compact, multistage toolkit of custom and open-source components (PowerShell loaders, BabShell C++ reverse shell, in-memory loaders, Remcos/VRAT) to gain access, move laterally, and exfiltrate sensitive documents and WhatsApp data via tailored spear-phishing and per-victim wildcard DNS C2 infrastructure.