Loading threat actor…
SloppyLemming is an India-nexus cyber-espionage threat actor active since at least 2021 and also tracked as Outrider Tiger and Fishing Elephant. The group primarily targets government entities and critical infrastructure operators in South Asia, with sustained activity against Pakistan and Bangladesh and additional reported targeting in Sri Lanka, Nepal, Indonesia, China, and other South and East Asian countries. Victim sectors and organizations align with strategic intelligence collection priorities, including nuclear-regulatory bodies, defense and military-related organizations, logistics, telecommunications, energy utilities, financial institutions, law enforcement, and technology entities. SloppyLemming relies heavily on spearphishing and social engineering rather than publicized zero-day exploitation. Observed infection chains use malicious PDF lures, macro-enabled Excel documents, ClickOnce-based execution, and DLL sideloading to deploy custom malware. Recent campaigns from 2025 to 2026 delivered BurrowShell, a custom backdoor with remote shell, file manipulation, screenshot capture, and network tunneling functionality, alongside a Rust-based keylogger and remote access trojan with keylogging, command execution, screenshotting, port scanning, and network-enumeration capabilities. The actor has also previously used Ares RAT, WarHawk, NekroWire RAT, Cobalt Strike, and Havoc. The group has expanded its use of cloud and edge-hosted infrastructure, especially Cloudflare Workers, for payload delivery and command-and-control. Its tradecraft includes defense evasion through staged multi-step execution, in-memory payload execution, masquerading of command-and-control traffic as legitimate service traffic, and use of legitimate signed binaries for sideloading chains. Reporting also notes recurring operational security weaknesses, including exposed directories on attacker infrastructure, which contributed to the “Sloppy” moniker. Overall, SloppyLemming is assessed as a moderately capable, state-aligned espionage actor focused on regional intelligence collection in support of Indian strategic interests.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses trust-based execution chains including ClickOnce, LNK, and ISO, and develops multiple malware variants in AI-assisted and non-mainstream programming languages.
Activity cluster reported deploying BurrowShell and a Rust-based RAT, targeting Pakistan and Bangladesh.
Deploying BurrowShell and a Rust-based RAT in operations targeting Pakistan and Bangladesh.
Conducting cyber-espionage style intrusions against government and critical infrastructure in South Asia using spear-phishing and malicious Excel/PDF lures to deliver a loader that deploys the BurrowShell backdoor, and a second chain delivering a Rust-based keylogger with port scanning and network enumeration; leveraging Cloudflare Workers domains for C2.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.