Confucius (Confucius APT)
Suspected India-linked espionage group (vendor assessment) phishing Pakistani military, government and diplomatic targets since 2013, plus Hornbill and SunBird Android spyware.
- Active
- 2013 to September 2025
- Origin
- India (vendor assessment; no government attribution)
- Affiliates
- Patchwork (shared backdoor code, configuration and some infrastructure per Trend Micro, which treats them as separate groups), SideWinder (shared shortcut-file metadata per Antiy, called speculative), Urpage and Bahamut (shared Delphi file stealer per Trend Micro), also called Moloch (per Antiy)
- Regions targeted
- Pakistan, India (Kashmir), China, Bangladesh, South Asia, Middle East, Pakistani embassies abroad (Brunei, Nepal, Argentina, Azerbaijan), United Arab Emirates
- MITRE ATT&CK
- G0142
What each vendor calls it
Also known as Confucius APT
Profile
Confucius is a South Asian espionage group that has gone after Pakistan’s military and government for more than a decade. MITRE ATT&CK dates its activity to at least 2013 and describes its targets as military personnel, high-profile people, business people and government organizations in South Asia. The name comes from its malware: Antiy’s chief engineer told China’s Global Times that the group’s implants issue commands with the phrase “Confucius says”. No government has formally attributed the group. Lookout calls it a “state-sponsored, pro-India actor”, Unit 42 said in 2016 that its activity had “likely Indian origins”, and FortiGuard Labs describes it as believed to have links to state-sponsored operations in the region. All of that is vendor assessment. The most public India attribution came from the Chinese firm Antiy, through Chinese state media, in July 2022.
Pakistan is the constant. Lures over the years have impersonated the Pakistani armed forces’ public relations wing, the Federal Board of Revenue, the Prime Minister’s Office, the Ministry of Foreign Affairs and the Defence Housing Authority, and have used themes such as army casualty lists, staff vaccination records and a warning about Pegasus spyware. Targets reach past Islamabad: Antiy says the group also hit government, military and energy targets in China and Bangladesh, Uptycs found decoys about India-China border tensions, Taiwan and US nuclear policy, and Pakistani media reported, citing an official document, that the group went after Pakistani embassies in Brunei, Nepal, Argentina and Azerbaijan in 2022. Unit 42 saw some victims in the Middle East.
The group’s trademark is social engineering more than exploits. Rapid7’s 2013 write-up of the ByeBye Shell backdoor (which Unit 42 later tied to the Confucius cluster) found no exploits at all, just spearphishing and the T1036.002 (Masquerading: Right-to-Left Override) trick to disguise executables. Trend Micro’s 2018 research went further: operators ran fake romance personas and pushed their own trojanized chat apps (Secret Chat Point for Windows, Tweety Chat for Android), even urging group-chat members to install them on other people’s devices, and set up fake adult-content and “find a partner” sites. Exploits do appear, usually old Office ones: CVE-2015-1641 and CVE-2017-11882 in 2018, and in 2021 a chain that combined T1221 (Template Injection) with the Equation Editor flaw CVE-2018-0802 to drop Warzone RAT. Since 2021 the usual delivery has been password-protected macro documents, LNK shortcuts and PowerPoint show files, behind look-alike Pakistani government domains, Cloudflare and country filtering so that only targets in the right place receive a payload.
The tooling is mostly home-grown and changes often. Early backdoors such as ByeBye Shell and the two families Unit 42 called CONFUCIUS_A and CONFUCIUS_B looked up their command-and-control addresses from text posted on Yahoo Answers and Quora, an early case of T1102.001 (Web Service: Dead Drop Resolver). Later came Delphi file stealers (sysctrls, and a “BioData” stealer Trend Micro also found in Patchwork and Urpage operations), a stream of .NET file stealers that check file hashes so they never upload the same document twice, a C++ backdoor, the MessPrint backdoor documented by NSFOCUS, and borrowed tools such as QuasarRAT and Warzone RAT. FortiGuard Labs’ October 2025 report traced a move from the WooperStealer document thief (December 2024 and March 2025) to AnonDoor, a modular Python backdoor that can run commands, take screenshots, list and download files and dump browser passwords (August and September 2025).
The mobile side is where the most surprising findings sit. In February 2021 Lookout tied two Android spyware families, Hornbill and SunBird, to Confucius with high confidence. Both appear to descend from commercial stalkerware: Hornbill from the MobileSpy code base, SunBird from Indian developers behind another product Lookout calls BuzzOut. Lookout traced Hornbill’s developers to app companies around Chandigarh, one of whom had claimed on LinkedIn to work at India’s Defence Research and Development Organisation. Six poorly secured SunBird servers exposed more than 18 GB of stolen data, which showed monitoring of someone applying to the Pakistan Atomic Energy Commission, people with many contacts in the Pakistan Air Force, and election Booth Level Officers in Kashmir’s Pulwama district. Uploads from one target resumed on April 11, 2019, the day India’s general election began.
Confucius sits inside a tangle of South Asian groups that share code. Trend Micro found it while researching Patchwork: the two share backdoor code, commands, configuration structure and some infrastructure, and in 2021 a Patchwork-linked mail domain sent Confucius lures. Trend Micro still treats them as separate groups, possibly from the same community, with Patchwork leaning on malware and Confucius on social engineering. Antiy reported a shortcut file whose metadata matched one used by SideWinder, which it read as possible tool sharing and called speculative. Trend Micro also tied the group to Urpage and Bahamut through a shared Delphi file stealer, and Antiy notes that the group is also known as Moloch.
Events
| Date | Target | Narrative | Source | Our coverage |
|---|---|---|---|---|
| 2025-08 to 2025-09 | Windows users in Pakistan | A new LNK shortcut (NLC.pdf.lnk) side-loads a DLL that builds a Python environment and installs AnonDoor, a Python backdoor whose server only serves targets in chosen countries such as Pakistan. A browser password-dumping task for Firefox and Edge was seen in September. | FortiGuard Labs | |
| 2025-03 | Users in Pakistan | Invoice-themed LNK files copy a legitimate Windows binary (fixmapi.exe) under a new name to side-load a malicious DLL, show a decoy PDF and install WooperStealer, with registry persistence. | FortiGuard Labs | |
| 2024-12 | Users in Pakistan | Phishing email spoofing an authority delivers a PowerPoint show file that displays a “corrupted page” while an embedded object runs a remote script; a VBScript dropper side-loads a DLL and installs the WooperStealer document thief. | FortiGuard Labs | |
| 2022-11 | Armed forces in Multan and Pakistani government and diplomatic departments | Word documents themed on an intelligence-based operation report and US State Department funding drop a PowerShell loader via a scheduled task, which fetches a new MessPrint backdoor variant. | NSFOCUS | |
| 2022-03 to 2022-06 | Pakistani embassies in Brunei, Nepal, Argentina and Azerbaijan | According to a Pakistani official document reported by ProPakistani, PDF attachments link to phishing sites imitating government websites that hand out passwords to malicious documents; macros drop downloaders, file stealers, QuasarRAT and a custom C++ RAT. | ProPakistani | |
| 2021-06 to 2022-06 | Pakistani government and military institutions | Antiy tracks a run of lures (army casualty list, Pegasus warning, tax declaration, staff vaccination table, Prime Minister’s Office application form, Foreign Ministry content) served from look-alike government domains hidden behind Cloudflare and Branch deep links, dropping .NET stealers, QuasarRAT and a C++ backdoor. Antiy notes a shortcut file sharing metadata with a SideWinder sample. | Antiy | |
| 2022-07 | Governments, militaries and energy sectors in Pakistan, China and Bangladesh | Chinese state media, citing Antiy, publicly attributes Confucius to India after an 18-month investigation; Pakistan’s national IT security board had warned of phishing emails sent in the Prime Minister’s Office’s name. | Global Times (citing Antiy) | |
| 2021-08 | Pakistani military personnel | Emails spoofing the armed forces’ PR wing warn about Pegasus spyware and link to a password-protected Word file; macros load a .NET downloader chain ending in a file stealer that is never written to disk in clear text. A Defence Housing Authority lure used the same payload. | Trend Micro | |
| 2021-04 | Pakistani targets | Lure impersonating the Federal Board of Revenue, with an encrypted document attached and the password sent separately; the file stealer exfiltrated over FTP. | Trend Micro | |
| 2020-10 to 2021-01 | Government targets in South Asia, including lures for Pakistan’s space agency SUPARCO | Word documents about Chinese cruise missiles, the Taiwan Strait and US nuclear policy use T1221 (Template Injection) to pull a remote RTF that exploits CVE-2018-0802 and installs Warzone RAT, persisting through a Startup-folder shortcut. | Uptycs | |
| 2018 to 2019 | Pakistani nationals in Pakistan, India and the UAE; Pakistan Air Force contacts; election officials in Pulwama, Kashmir | SunBird Android spyware disguised as security, news, sports and Quran apps steals messages, WhatsApp and BBM content, call logs and location. Data exposed on six insecure servers included a Pakistan Atomic Energy Commission applicant and Booth Level Officers monitored from the start of India’s 2019 election. | Lookout | |
| 2018-05 to 2020-12 | Android users in South Asia | Hornbill, a quieter surveillance tool derived from MobileSpy code, records WhatsApp calls through accessibility services and uploads only changes to save battery; the newest sample Lookout found dated from December 2020. | Lookout | |
| 2018-08 | Urdu and Arabic speakers; Kashmir-themed decoys | Trend Micro links Confucius, Patchwork and Bahamut to a cluster it calls Urpage through a shared Delphi backdoor and file stealer and overlapping RTF downloaders. | Trend Micro | |
| 2018-05 | Pakistani targets | A fake adult site pushes the “Fuddi Duniya” Android spyware, and a fake partner-finding site offers a RocketChat-based Windows chat app that downloads the sysctrls Delphi file stealer only for victims in allowed countries. | Trend Micro | |
| 2018-02 | Military personnel, government officers and business people in South Asia | Romance personas talk targets into installing backdoored chat apps; Office files exploit CVE-2015-1641 and CVE-2017-11882; the swissknife2 stealer exfiltrates to cloud storage, which held data from about 60 victims. | Trend Micro | |
| 2017-01 | Android users in South Asia | Earliest SunBird sample Lookout observed, about a year before the group’s previously known first mobile malware. | Lookout | |
| 2016-09 | Targets in the Middle East and Asia, focused on Pakistan | Unit 42 names the Confucius cluster: self-extracting lures and a right-to-left override PowerPoint disguise; backdoors decode their server addresses from text posted on Yahoo Answers and Quora. | Unit 42 | |
| 2013 | Mostly Pakistani targets | Rapid7 documents the ByeBye Shell backdoor, delivered by spearphishing with no exploits and Pakistan-politics decoys copied from real news articles. Unit 42 later links ByeBye Shell (SNEEPY) to Confucius. | Rapid7 |
Target vectors risk profile
| Government | Defense | Diplomatic | Espionage | Mobile devices | Elections | Energy | Education/research | Manufacturing | Finance | Ransomware/extortion |
|---|---|---|---|---|---|---|---|---|---|---|
| High | High | High | High | High | Medium | Medium | Medium | Low | N/A | N/A |
Malware and tools
| Name | What it does | Public detection | Hunt Leads | Reports |
|---|---|---|---|---|
| AnonDoor | Modular backdoor (.NET and Python versions) that profiles the host, runs commands, takes screenshots, lists and downloads files and dumps browser passwords | Indicators and FortiGuard detection names in FortiGuard Labs’ report | FortiGuard Labs | |
| WooperStealer | Document, image, email and archive stealer that enumerates drives and uploads files with hashes to avoid duplicates | Indicators in FortiGuard Labs’ report | FortiGuard Labs | |
| MessPrint | Backdoor that sends host information to its server and downloads and runs files and commands | Indicators in NSFOCUS’s report | NSFOCUS | |
| .NET file stealers and downloaders | Multi-stage macro-launched chain ending in a stealer that takes documents and images from user folders and other drives | Indicators in Antiy’s report; Trend Micro detection names in its report | Trend Micro, Antiy | |
| C++ backdoor | Discovery, file transfer, command execution and reverse shell; Antiy saw an earlier version in September 2020 | Indicators in Antiy’s report | Antiy | |
| QuasarRAT | Open-source remote access trojan, dropped by Excel macros and obfuscated with .NET Reactor | Indicators in Antiy’s report | Antiy | |
| Warzone RAT | Commercial RAT with keylogging, password theft, webcam capture and UAC bypass | YARA rule and indicators in Uptycs’ report | Uptycs, MITRE ATT&CK | |
| SunBird | Android RAT that uploads messages, WhatsApp, BBM and IMO content, call logs, browser history and location | Indicators in Lookout’s report | Lookout | |
| Hornbill | Android surveillance tool that records calls and WhatsApp calls, scrapes WhatsApp through accessibility services and tracks location | Indicators in Lookout’s report | Lookout | |
| Secret Chat Point, Tweety Chat, Fuddi Duniya | Trojanized chat and adult apps for Windows and Android that steal files, SMS, contacts and audio | Indicators in Trend Micro’s research appendix | Trend Micro (2018-02), Trend Micro (2018-05) | |
| sysctrls, swissknife2 and other Delphi stealers | File stealers for Office, Outlook and image files; swissknife2 exfiltrates to cloud storage; one Delphi stealer is shared with Patchwork and Urpage | Indicators in Trend Micro’s research appendix | Trend Micro, Trend Micro (Urpage) | |
| ByeBye Shell (SNEEPY), CONFUCIUS_A, CONFUCIUS_B | Early backdoors; the Confucius families resolve their servers from text on Yahoo Answers and Quora | Hashes in Rapid7’s report | Rapid7, Unit 42 |
Reports
Vulnerabilities exploited
| Vulnerability | CVSS | Severity | Publisher | Platform | CISA KEV |
|---|---|---|---|---|---|
| CVE-2018-0802 | 7.8 | High | Microsoft | Office Equation Editor | Yes |
| CVE-2017-11882 | 7.8 | High | Microsoft | Office Equation Editor | Yes |
| CVE-2015-1641 | 7.8 | High | Microsoft | Microsoft Word / Office | Yes |
If you’re in their sights
Do this now
- Treat shortcut files, PowerPoint show files and password-protected documents arriving by email or download link as hostile. Block LNK files inside email and archives, and keep Office macros blocked for files from the internet: almost every Confucius chain since 2021 starts with one of these.
- Patch or remove the old Office Equation Editor and keep Office current. The group’s exploits are years old (CVE-2017-11882, CVE-2018-0802, CVE-2015-1641) and only work on machines that were never updated.
- Hunt for its persistence: scheduled tasks that run every few minutes, new Run keys or Startup-folder shortcuts, renamed copies of legitimate Windows programs (such as fixmapi.exe) sitting in user folders next to an unfamiliar DLL, and pythonw.exe running from odd paths.
- Verify emails that claim to come from ministries, tax authorities or the armed forces through a separate channel, especially when the password for an attachment arrives in the same message or the next one.
- For staff in defense, nuclear, diplomatic or election roles, allow phone apps only from the official store, manage devices centrally, and watch for apps that ask for accessibility or device-administrator rights: that is how Hornbill and SunBird read WhatsApp and record calls.
Compiled from FortiGuard Labs, Lookout, Trend Micro, Unit 42, Rapid7, Uptycs, Antiy, NSFOCUS, ProPakistani, Global Times and MITRE ATT&CK. Last reviewed November 1, 2026.
ATT&CK techniques (19)
Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.