Mysterious Elephant an infrastructure map & IOC blocklist to protect Asia’s governments
Summary: A stealthy, targeted campaign we’ll call “Mysterious Elephant” is actively exploiting government targets in Asia.
A stealthy, targeted campaign we’ll call “Mysterious Elephant” is actively exploiting government targets in Asia. Below you’ll find a clear, vendor‑neutral infrastructure map overview (so your security teams can visualize the attack surface), a concise, copy‑ready table of Indicators of Compromise (IOCs) to block or ingest into prevention/detection systems, and practical defensive steps your organization can act on today.
What “Mysterious Elephant” looks like
Think of the intrusion as a multi‑stage chain with clean separation between reconnaissance, initial access, persistence/command-and-control, and exfiltration. Present this map to your blue team, network team, and SIEM/SOC for rapid onboarding and detection tuning.
1. Lure & initial access (malicious documents / compressed archives)
Attackers deliver weaponised docs inside RAR archives and socially engineered invitations (e.g., targeted ministry or conference invites).
These archives unpack and drop loaders or DLLs that launch in memory or as side‑loaded components.
2. Loaders / Memory loaders
Small loader modules (MemLoader variants) run in memory or as DLLs to avoid disk detection. They may use names similar to legitimate components (e.g., STI.dll, Edge.exe, etc.).
3. Backdoors / Remote shells
Shell components and backdoors (BabShell and similarly named binaries) provide remote command capability and lateral movement.
4. Exfiltration agents
Several specialized exfiltrators (Uplo, Stom, ChromeStealer) harvest browser data, tokens, files and move them to attacker‑controlled hosts.
5. C2 (command-and-control) & staging
Compromised hosts contact attacker domains and IPs over HTTP/HTTPS (some on nonstandard ports), using obfuscated hostnames and dynamic services (DDNS, cloud subdomains) to blend in.
6. Operational chaining
The campaign mixes memory‑only components and short‑lived disk artifacts to frustrate traditional AV. It uses multiple domain families and a few static IPs for redundancy.
Quick defensive priorities:
1. Block and sinkhole the attacker domains and IPs at DNS and network perimeter (use the IOC table below).
2. Deploy hash and filename blocking / quarantine for the listed malicious artifacts across EDR/AV and email gateways.
3. Hunt for memory‑resident loaders and processes with suspicious parent/child relationships (e.g., Office → RAR extractor → unexpected DLL injection).
4. Monitor lateral movement patterns (SMB, remote services, remote debugging tools) and unusual persistence mechanisms.
5. Harden mail gateways: enforce attachment blocking for RAR/unknown archives, enable safe extract and content disarm/rewrap where possible.
6. Segment sensitive networks (ministries, critical admin consoles) and enforce strict MFA + just‑in‑time access for privileged accounts.
7. Ingest IOCs into your firewall, DNS resolver, EDR, proxy, and SIEM. Automate alerts for matches and blocklists updates.
Table of IOCs, copy‑ready blocklist / ingestion table
File hashes & filenames
| Type | Value | Notes / Suggested action |
|---|---|---|
| Malicious archive (document) | c12ea05baf94ef6f0ea73470d70db3b2, M6XA.rar | Block / quarantine at email gateway and EDR; add hash to AV/EDR blocklists |
| Malicious archive (document) | 8650fff81d597e1a3406baf3bb87297f, 2025-013-PAK-MoD-Invitation_the_UN_Peacekeeping.rar | High priority, targeted lure. Block and search email logs for deliveries |
| MemLoader (HiddenDesk variant) | 658eed7fcb6794634bbdd7f272fcf9c6, STI.dll | Add to EDR/AV blocklist; hunt for DLL side‑loading artifacts |
| MemLoader (HiddenDesk variant) | 4c32e12e73be9979ede3f8fce4f41a3a, STI.dll | Same as above, treat as related sample |
| MemLoader (Edge variant) | 3caaf05b2e173663f359f27802f10139, Edge.exe, debugger.exe, runtime.exe | Block executable names and hash; flag processes spawned from nonstandard parents |
| MemLoader (Edge variant) | bc0fc851268afdf0f63c97473825ff75 | Add to blocklist / EDR |
| BabShell | 85c7f209a8fa47285f08b09b3868c2a1 | Block and hunt for network beacons from hosts with this hash |
| BabShell | f947ff7fb94fa35a532f8a7d99181cf1 | Block / hunt |
| Uplo exfiltrator | cf1d14e59c38695d87d85af76db9a861, SXSHARED.dll | Block and monitor for unusual file transfer activity |
| Stom exfiltrator | ff1417e8e208cadd55bf066f28821d94 | Block |
| Stom exfiltrator | 7ee45b465dcc1ac281378c973ae4c6a0, ping.exe | Block common stealth filenames; search for copies in unusual locations |
| Stom exfiltrator | b63316223e952a3a51389a623eb283b6, ping.exe | Block |
| Stom exfiltrator | e525da087466ef77385a06d969f06c81 | Block |
| Stom exfiltrator | 78b59ea529a7bddb3d63fcbe0fe7af94 | Block |
| ChromeStealer exfiltrator | 9e50adb6107067ff0bab73307f5499b6, WhatsAppOB.exe | Block, hunt for browser token theft and credential exfiltration |
Domains / hostnames / network
| Type | Value (analyst‑safe) | Notes / Suggested action |
|---|---|---|
| Malicious site | hxxps://storycentral[.]net | Block at DNS/proxy; add to web filter denylist |
| Malicious site | hxxp://listofexoticplaces[.]com | Block |
| Malicious site | hxxps://monsoonconference[.]com | Block, lure theme: conferences/events |
| Malicious C2 (nonstandard port) | hxxp://mediumblog[.]online:4443 | Block IP/DNS and port; monitor outbound connections to that host |
| Malicious C2 (nonstandard port) | hxxp://cloud.givensolutions[.]online:4443 | Block |
| Malicious C2 (standard/443) | hxxp://cloud.qunetcentre[.]org:443 | Block |
| Malicious domain | solutions.fuzzy-network[.]tech | Block |
| Malicious domain | pdfplugins[.]com | Block, often used to masquerade as PDF utility |
| Malicious domain | file-share.officeweb[.]live | Block, masquerading as file sharing |
| Malicious DDNS | fileshare-avp.ddns[.]net | Block; flag dynamic host usage |
| IP address | 91.132.95[.]148 | Block at perimeter / firewall; add to network denylist |
| IP address | 62.106.66[.]80 | Block |
| IP address | 158.255.215[.]45 | Block |
Detection & blocking recommendations
DNS / Proxy: Add the listed domains to DNS sinkhole and proxy denylist; alert on failed DNS lookups for those domains that appear in logs.
Firewall / Perimeter: Block outbound traffic to the listed IPs and to the unusual ports cited (e.g., :4443), or at minimum log and alert.
Email Gateway: Block RAR attachments from external senders; quarantine messages that match archive filenames or contain the listed hashes.
Endpoint / EDR: Ingest the file hashes and automate containment on match; look for process trees like winword.exe -> rar.exe -> Edge.exe/STI.dll or suspicious DLL side‑loading.
SIEM: Create correlation rules for: unusual outbound HTTPS to new domains, new executables running from user temp folders, repeated attempts to connect to the listed IPs.
Browser hardening: Block or restrict extension installs and third‑party credential export tools; monitor for automated Chrome/WhatsApp token extraction behaviours.
Threat hunting: Search for the provided filenames and hashes across file servers and endpoints; hunt for suspicious persistence entries, scheduled tasks, registry autoruns.
How we help (services we can deploy for you)
Rapid ingestion of the provided IOC list into your perimeter and endpoint controls (policy creation, blocklist automation).
Full infrastructure mapping & attack surface review, produce a visual, prioritized map of exposed services and likely attacker paths (deliverable: executive map + technical playbook).
Threat hunting across logs and endpoints to find any historical compromise tied to these IOCs.
Incident response & containment: triage infected hosts, remove persistence, and reimage where necessary.
Proactive controls: hardening, network segmentation, MFA rollout, and tabletop exercises to strengthen readiness.
“Mysterious Elephant” is subtle it relies on tailored lures, memory loaders, and multiple exfiltration tools. Blocking the domains, IPs, and hashes above, plus applying the detection and hardening measures listed, will materially reduce risk to government networks.
