ModifiedElephant

ModifiedElephant is a threat actor tracked by SentinelLabs that has operated since at least 2012 and was still active at the time of reporting. SentinelLabs attributed roughly a decade of targeted activity to the group, primarily against human rights activists, human rights defenders, academics, journalists, and lawyers across India. The reported objective was long-term surveillance and, in some cases, planting incriminating digital evidence on victim systems. SentinelLabs linked the actor to targeted attacks associated with the Bhima Koregaon case and assessed that its activity aligns sharply with Indian state interests, while stopping short of definitive attribution. ModifiedElephant primarily used spearphishing emails sent from free webmail providers such as Gmail and Yahoo, often repeatedly targeting the same individuals over extended periods. Delivery methods included malicious attachments and externally hosted files, with lures themed around activism, climate change, politics, and public service. The actor used executable attachments with fake double extensions in earlier activity and later shifted to less obvious file types including .doc, .pps, .docx, .rar, and password-protected .rar archives. Reported exploit use included CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, and CVE-2015-1641. The primary malware families associated with ModifiedElephant were the commodity RATs NetWire and DarkComet. The actor also used Visual Basic keyloggers and, in some campaigns, an unidentified Android commodity trojan delivered as an APK alongside NetWire payloads. SentinelLabs reported that the group often used new malware samples for individual infection attempts, though some payloads were reused across targets. A forensic report cited by SentinelLabs found that the file "Ltr_1804_to_cc.pdf" was delivered via a NetWire remote session associated with the actor, and SentinelLabs observed nearly identical evidence creation and organization across multiple unrelated victim systems within a short time window. Reported overlaps include infrastructure overlap via new-agency[.]us with Operation Hangover, and some victims were also targeted by other surveillance clusters, including SideWinder phishing and NSO Group Pegasus. Known alias in the provided content: modifiedelephant.