Confucius

Summary

Espionage group (MITRE G0142) active since at least 2013 against military personnel, officials, business people and government organisations in South Asia, above all in Pakistan. MITRE notes similarities with Patchwork in custom malware and targets, and Fortinet says it is believed to have links to state-sponsored operations in the region; neither names a country, so the record holds it as Unknown. It phishes with malicious attachments and links (T1566.001, T1566.002), exploits Office flaws CVE-2015-1641, CVE-2017-11882 and CVE-2018-0802 (T1203), uses template-injected RTF documents (T1221), mshta-run VBScript (T1218.005, T1059.005) and scheduled tasks (T1053.005), and steals documents with a file stealer that exfiltrates to cloud storage (T1119, T1567.002). Fortinet traced a Pakistan-focused run from December 2024, using PPSX and later LNK lures that dropped WooperStealer, to August 2025, when it switched to the Python backdoor AnonDoor.

Attribution

Fortinet: links to state-sponsored operations in South Asia; no country named

Tracked by researchers; no state or organisation has been publicly attributed.

• MITRE ATT&CK (MITRE ATT&CK, 2026-07-31)
  South Asia-focused espionage group; no country named
• Fortinet FortiGuard Labs (Research, 2025-10-02)
  Believed to have links to state-sponsored operations in the region (no country named)

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 9

Malware and tools 2

Exploited vulnerabilities 3

Highest CVSS first.

Infrastructure patterns

• Malicious LNK and PPSX lures leading to .NET downloaders and stealers (Fortinet 2025)

Reporting and advisories 2

• MITRE ATT&CK
  G0142 — Confucius
• Fortinet FortiGuard Labs
  Confucius Espionage: From Stealer to Backdoor (Oct 2025)