DoNot Team
Also known asDoNot · APT-C-35
Summary
South Asia-focused espionage group (APT-C-35) active since at least 2016, which several vendors link to India (Trellix); no government has attributed it. It targets government, foreign-affairs, defence and NGO organisations in South Asia and, increasingly, Europe — in 2025 Trellix documented an intrusion into a European foreign ministry handling South Asian affairs with its exclusive LoptikMod malware. In 2026 it targeted Bangladesh's military and defence personnel with a lure impersonating a Bangladesh Air Force officer: a weaponised RTF using remote-template injection pulls a VBA shellcode loader, chained XOR-encoded downloaders disguised as .ico/.mp3/.doc files, and a DLL implant persisting as a fake OneDrive telemetry task (Cyderes, high confidence); Bangladesh's national CIRT issued an advisory in Aug 2026. Amnesty International (2021) linked its Android spyware used against a Togolese activist to the Indian company Innefu Labs.
Attribution
No government attribution of the state link
Hedged, circumstantial or press-only reporting; not established.
- Trellix (Research, 2025-07-08)
Several vendors attribute links to India - Bangladesh e-GOV CIRT (Government, 2026-08-17)
Advisory on DoNot activity; names no state
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Bangladesh military and defence personnel — Air Force officer lure, RTF remote template → shellcode chain | 2026 | Bangladesh | Military, Defense | Cyderes (2026-07-15); BGD e-GOV CIRT advisory (2026-08-17) |
| European foreign affairs ministry — LoptikMod | 2025 – 2025-07 | EU | Diplomatic, Government | Trellix (2025-07-08) — activity dates not stated; reported July 2025 (start is the publication year) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1053.005Scheduled Task |
| Stealth2 | T1221Template InjectionT1036.004Masquerade Task or Service |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| LoptikMod | Backdoor (exclusive to DoNot since 2018) | Windows |
| ejtest.dll | Second-stage module retrieved from live C2 (2026) | Windows |
Infrastructure patterns
- Server-side geofencing: payloads served only to victims in the target region (Cyderes, 2026; BGD e-GOV CIRT, 2026)