VICEROY_TIGER__2019__LUCKY_ELEPHANT_Campaign_Masquerading.pdf

ASERT researchers analyze the LUCKY ELEPHANT credential harvesting campaign that uses doppelganger webpages to harvest login credentials by impersonating government, telecommunications, and military entities in South Asia. The operation is primarily credential theft via phishing with no observed malware payloads; infrastructure includes a small set of IPs and domains, some tied to Indian and Chinese APT activity, and targets governments in the region with recommendations to monitor IOCs and enforce MFA.