India-Linked Hacker Group SloppyLemming Targets Bangladeshi Govt. and law agency

Cloudforce One has identified the cyber group “SloppyLemming,” responsible for extensive attacks across South Asia, particularly targeting Bangladesh, Pakistan, Sri Lanka, and China. The group uses cloud services for credential harvesting, malware distribution, and C2 activities, primarily affecting government, law enforcement, energy, telecom, and tech sectors. Linked to the APT group OUTRIDER TIGER, SloppyLemming frequently employs tools like Cobalt Strike and Havoc to target these regions.

How Credential Harvesting Works

SloppyLemming’s operations often begin with phishing campaigns, where carefully crafted emails are sent to potential victims. These emails are designed to trick the recipient into clicking a malicious link, leading to stolen login credentials. According to Cloudforce One, the actor tailors phishing emails to ensure a high success rate. An example obtained during the investigation reveals how meticulously the emails are designed to look legitimate, increasing the likelihood of their success.

The threat actor utilizes a custom-made tool called CloudPhish to deploy a malicious Cloudflare Worker. This worker manages the credential logging process and sends the stolen credentials back to the attacker. CloudPhish operates as follows:

The operator initiates CloudPhish by entering the following parameters:

• Mission name (usually referring to the operation’s target)
• Target URL
• Discord Webhook URL
• Redirect URL
• Cloudflare URL

Next, the tool:

1. Scrapes the HTML content of the target’s webmail login page.
2. Verifies whether it’s a support mail client (such as Zimbra, Axigen, or cPanel).
3. Replaces the legitimate code in the scraped webmail login page with a link directing users to a malicious Cloudflare Worker endpoint.
4. Compiles the final Worker script.
5. Inserts the fraudulent HTML code of the spoofed login page with a redirect to the attacker-controlled Worker.
6. Implements credential logging and exfiltration via Discord.

Once ready, SloppyLemming operators send phishing emails to their targets. Upon receiving login credentials, the actor accesses the victim’s account to retrieve emails of interest. Cloudforce One obtained a copy of a likely actor-side script used to collect emails from compromised accounts, with key portions detailed below.

Malware Operations

In July 2024, cybersecurity experts from Cloudforce One discovered a malware campaign using Dropbox to exploit a vulnerability in older WinRAR versions (CVE-2023-38831). The operation, linked to the SloppyLemming malware, tricks users into downloading a RAR file named “CamScanner 06-10-2024 15.29.rar”, which contains malicious files disguised as PDFs.

When opened with a vulnerable version of WinRAR, the malware triggers an executable that downloads additional harmful components from Dropbox, including a Remote Access Tool (RAT). This RAT connects to a command server via Cloudflare Workers, posing a serious threat to users. Security experts advise updating software to avoid such attacks.

Additional C2 Infrastructure And Traffic Analysis

Recent investigations into a domain associated with malicious activity, pitb.zapto[.]org, have revealed ties to an extensive network of cyber infrastructure. This domain, currently linked to an Alibaba IP address (47.74.10[.]112) These findings indicate a potential actor-controlled infrastructure that may be part of broader cyber espionage operations.

• sco.zapto[.]org
• mofapak[.]info  
• confidential.zapto[.]org  
• humariweb[.]info 
• modp-pk[.]org  
• itsupport-gov[.]com

According to cybersecurity experts at Cloudforce One, the hacker group known as SloppyLemming has also used several domains—many leveraging Cloudflare’s reverse proxy services. 

• apl-org[.]online 
• apl-com[.]icu 
• maldevfudding[.]com 
• navybd-gov[.]info 
• 168-gov[.]info 
• aljazeerak[.]online 
• adobefileshare[.]com 
• crec-bd[.]site
• quran-books[.]store
• hurr.zapto[.]org
• hascolgov[.]info
• helpdesk-lab[.]site

A review of C2 (Command and Control) traffic between September 1st and 6th of 2024 showed significant activity across Pakistan, Bangladesh, and Sri Lanka. Interestingly, a notable amount of traffic was also traced to Australian IP addresses, specifically from Canberra. This raises concerns that the actor may have expanded their focus, potentially targeting Australian government entities.

The hacker group’s typical targets include Pakistan, Bangladesh, and Sri Lanka, but recent C2 traffic from Australian IPs, particularly in Canberra, suggests they may be expanding their focus. This could indicate government-related targeting in Australia, highlighting the evolving nature of their operations.

Majority of targeted organizations falling within the following categories:

• Government
  • Law enforcement
  • Defense
  • Legislative organizations
  • Foreign Affairs
  • Transportation
  • Logistics
• Technology
  • IT providers
  • Telecommunications
• Energy
  • Construction
  • Equipment operators
• Education
  • Universities

The India-linked hacker group “SloppyLemming” has been conducting widespread cyberattacks across South Asia, targeting key sectors such as government, law enforcement, telecommunications, and technology. Utilizing tools like CloudPhish for credential harvesting and deploying malware through services like Dropbox and Cloudflare, the group focuses heavily on Pakistan, Bangladesh, and neighboring countries. Their operations include malware distribution, credential theft, and C2 traffic, with a notable expansion of activity to Australian IP addresses, indicating potential government-related targeting. The group’s evolving tactics and international reach make them a significant cybersecurity threat.

Indicators of Compromise

SloppyLemming Infrastructure

SloppyLemming Malware Samples

Mitigated SloppyLemming Workers Domains

• mail-na-gov-pk.na-gov-pk.workers[.]dev
• storage-e13.sharepoint-e13.workers[.]dev
• zoom.osutuga7.workers[.]dev
• sharepoint-punjab.sharepoint-e13.workers[.]dev
• pitb.gov-pkgov.workers[.]dev
• mail-islamabadpolice-gov-pk.ntc-telecommunication-safecity.workers[.]dev
• herald-b2a.workers[.]dev
• images-11d.workers[.]dev
• classifieds.workers[.]dev
• dawnnews.workers[.]dev
• aurora.dawn-904.workers[.]dev
• epaper.dawn-323.workers[.]dev
• obituary.workers[.]dev