SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

Arctic Wolf links SloppyLemming to a Jan 2025–Jan 2026 campaign targeting government and critical infrastructure in Pakistan and Bangladesh using spear-phishing with ClickOnce and macro-laden Excel to deploy an in-memory backdoor (BurrowShell) and a Rust-based keylogger; the actor used DLL side-loading, Havoc C2, RC4-protected payloads, and extensive Cloudflare Workers typo-squatted domains to support operations.