Loading threat actor…
Cosmic Leopard is a Pakistan-linked cyber-espionage threat actor associated with long-running surveillance and intelligence-collection operations primarily targeting Indian individuals and organizations. The group has been tied to Operation Celestial Force, active since at least 2018, and is assessed to focus on victims in government, defense, and related technology sectors. Reporting also indicates operational overlap in tooling, tactics, and victimology with Transparent Tribe (APT36), although available evidence does not conclusively establish that the two are the same actor. Cosmic Leopard has used a multi-component malware ecosystem centered on GravityRAT, including Windows and Android variants, alongside the HeavyLift malware loader and the GravityAdmin administration utility. Earlier activity involved distributing Windows-based GravityRAT through malicious documents, later expanding to Android targeting and loader-based delivery. HeavyLift has been used to register compromised hosts, retrieve follow-on payloads, and maintain persistence across platforms, while GravityAdmin has supported management of multiple concurrent campaigns. The actor relies heavily on spear-phishing and social-engineering operations for initial access. Operators have reportedly cultivated contact with targets over social media, built trust, and then directed victims to download trojanized installers or malicious Android applications. Recent delivery methods have included websites masquerading as legitimate Android application download portals. Observed malware functionality supports surveillance and theft of victim data, including device and host information, messages, files, call-related data, location information, and other system details. Additional behaviors include persistence, follow-on payload delivery, and anti-analysis checks designed to evade virtualized or instrumented environments. Cosmic Leopard is best characterized as an espionage actor aligned with Pakistan-linked interests, with a sustained focus on intelligence collection against Indian strategic targets rather than financially motivated or destructive operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
104 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a Pakistan-linked group with operational overlap with APT36; no additional campaign details provided in the content.
Cosmic Leopard has conducted espionage campaigns against Indian government agencies and defense- and technology-related companies.
Conducting the long-running 'Operation Celestial Force' espionage and surveillance campaign against Indian entities and individuals, using GravityRAT, HeavyLift, and GravityAdmin across Windows and Android, primarily via spear-phishing and social engineering over social media.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.