ModifiedElephant__2022__modified-elephant-apt.pdf

ModifiedElephant is a decade-long targeted surveillance and evidence-fabrication campaign in India described by SentinelLabs: attackers used spearphishing (malicious Office docs, executables, large RARs) to deploy commodity RATs (NetWire, DarkComet), brittle Visual Basic keyloggers, and an Android trojan to exfiltrate data and plant incriminating files; the report includes infrastructure and file IOCs, discusses overlaps with other actors and potential state-aligned motives, and links intrusions to real-world arrests.