'Confucius' Cyberspy Evolves From Stealers to Backdoors in Pakistan

FortiGuard Labs researchers report that the Confucius APT (active since 2013 and linked to India-sponsored operations) has transitioned from using infostealers like WooperStealer to deploying Python-based backdoors such as AnonDoor in targeted campaigns against Pakistani government and military targets, employing spear-phishing, malicious LNK/DLL files, PowerShell loaders, MSIL downloaders, heavy obfuscation, and providing IoCs for defenders.