DoNot APT Hits European Ministry with New LoptikMod Malware

DoNot APT (aka APT-C-35/Mint Tempest) executed a sophisticated spear‑phishing operation against a European foreign affairs ministry by impersonating defence officials and delivering a Google Drive link that downloaded SyClrLtr.rar containing notflog.exe; the payload installed a batch file, created a scheduled task for persistence (every 10 minutes), and deployed LoptikMod which collects system details, encrypts them, and communicates with a C2. The report details TTPs, IOCs (e.g., sender int.dte.afd.1@gmailcom, SyClrLtr.rar, notflog.exe), historical attribution to the group, and recommends stronger email security, network monitoring, and EDR protections.