Mysterious Elephant: a growing threat
Kaspersky GReAT experts describe the latest Mysterious Elephant APT activity. The threat actor exfiltrates data related to WhatsApp and employs tools such as BabShell and MemLoader HidenDesk.
Contacts
Your antivirus vendor’s technical support can provide help in combating threats.
- If you use Kaspersky Anti-Virus or other Kaspersky Lab products, you can get information on combating threats either from technical support or in the Virus-related issues thread on the Kaspersky Lab forum.
- If you use an antivirus program from another vendor, contact the vendor’s technical support.
If you are experiencing problems with your security solution, contact your vendor’s technical support.
If you are looking for a description of a malicious or potentially unwanted program, and cannot find it on the site, you can ask us to write and publish a description.
If you have identified a vulnerability in a Kaspersky Lab product, please send details to vulnerability@kaspersky.com.
If you have identified a vulnerability in this or any Kaspersky Lab site, please send details to websecurity@kaspersky.com.
We cannot answer any queries on how to deal with malware or product functionality.
Reports
Sleep with one eye open: how Librarian Ghouls steal data by night
According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts.
Operation SyncHole: Lazarus APT goes back to the well
Kaspersky GReAT experts uncovered a new campaign by Lazarus APT that exploits vulnerabilities in South Korean software products and uses a watering hole approach.
IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia
MysterySnail RAT attributed to IronHusky APT group hasn’t been reported since 2021. Recently, Kaspersky GReAT detected new versions of this implant in government organizations in Mongolia and Russia.
