Confucius Espionage: From Stealer to Backdoor | FortiGuard Labs

The Confucius threat group, a state-aligned cyber-espionage actor, has evolved its tactics from using document stealers like WooperStealer to deploying Python-based backdoors such as AnonDoor. Initially targeting organizations in Pakistan via spear-phishing and malicious Office documents, the group has advanced to using LNK files, DLL side-loading, and scheduled tasks for persistence. Their campaigns now feature layered obfuscation, custom Python RATs, and sophisticated data exfiltration techniques, indicating a growing level of operational sophistication.

AI-extracted · verify before operational use