DoNot

DoNot Team is a South Asia-focused advanced persistent threat group active since at least 2016 and widely tracked as APT-C-35. It is also known by aliases including DoNot, Donot Team, Mint Tempest, Origami Elephant, SECTOR02, SectorE02, and Viceroy Tiger. Multiple vendors assess the group as India-aligned, and its operations are consistently characterized as cyber-espionage. DoNot Team primarily targets government, military, diplomatic, and foreign affairs entities across South Asia, with repeated activity against organizations in Bangladesh, Pakistan, Sri Lanka, and Nepal, as well as Kashmiri non-profit organizations and Pakistani officials. Reporting also shows expansion beyond its traditional regional focus, including targeting of a European foreign affairs ministry. The group has conducted sustained intelligence-gathering campaigns using both Windows and Android malware. Its intrusion activity commonly begins with spearphishing and malicious documents, including Microsoft Office files, RTF remote-template injection, exploit delivery using CVE-2017-11882, and archive-based lures themed around regional geopolitical issues such as Kashmir. DoNot Team has also been observed abusing Foxit PDF Reader behavior to induce user-assisted execution. Delivery chains often use staged loaders, shellcode, XOR-encoded or encrypted intermediate payloads, and DLL-based implants executed through rundll32 or similar mechanisms. The group demonstrates mature post-compromise tradecraft including host profiling, encrypted command-and-control, scheduled-task or startup-based persistence, anti-VM checks, dynamic API resolution, string encryption, selective payload delivery, and geofencing to restrict malicious content to intended victims. Windows toolsets associated with the actor include the yty malware framework and variants such as Gedit, DarkMusical, Henos, and LoptikMod. These toolsets support data collection and modular tasking, including file harvesting, screen capture, keylogging, reverse shell capability, downloader functionality, and exfiltration. DoNot Team also maintains an Android espionage capability. Its Android operations have used loaders such as Firestarter, which leverage Firebase Cloud Messaging for resilient tasking and selective second-stage delivery. Android payloads attributed to the group support extensive surveillance functions including collection of user, device, location, communications, application, and file data, and have been used in highly targeted campaigns related to India, Pakistan, and Kashmir. The actor’s operational pattern is consistent with long-term espionage against strategic and political targets, especially defense, diplomatic, and state institutions in South Asia.