Mysterious Elephant APT: How Hackers Use WhatsApp to Steal Sensitive Data

The Mysterious Elephant APT group, active since 2023, targets Asia-Pacific governments with spear phishing emails on diplomatic themes, using custom malware like BabShell and MemLoader to infiltrate networks. They exploit WhatsApp for data exfiltration, deploying RATs for reverse shells and in-memory execution, evading detection with obfuscated PowerShell scripts and scheduled tasks for persistence.

Attacks start with legacy vulnerabilities for entry, then focus on stealing documents, images, and archives via C2 servers, evolving from groups like Origami Elephant and SideWinder. This enables long-term espionage, including sensitive user data theft.

Defend by patching systems, monitoring network anomalies, providing phishing training, and sharing threat intel. Organizations should enable multi-factor authentication and restrict app data access to counter these sophisticated threats.

NPAV offers a robust solution to combat cyber fraud. Protect yourself with our top-tier security product, FraudProtector.net