Bahamut__2017__bellingcat_-_Bahamut_Revisited_More_Cyber_Espionage_in_the_Middle_East_and_South_Asia_-_bellingcat.pdf

Bellingcat's "Bahamut Revisited" updates previous research on a targeted cyber-espionage campaign operating in the Middle East and South Asia, documenting spearphishing, credential-harvesting infrastructure, and custom Android/Windows malware linked to espionage against diplomats, journalists, and organizations related to Kashmir and regional political interests; the report provides IOCs, domain and hash overlaps with other campaigns, and analysis suggesting the group operates as a hacker-for-hire.