Do Son 
At a glance
| Actor / group | DoNot (APT-C-35); assessed by multiple vendors as India-aligned |
| Activity type | Targeted cyber-espionage via spear-phishing and RTF template injection |
| Targets / victims | Bangladesh military and defence personnel |
| Scale | Active campaign; live C2 serving second-stage modules (victim count undisclosed) |
| Status | Ongoing; no arrests; infrastructure still live during analysis |
| Source | Cyderes Howler Cell |
TL;DR
Researchers at Cyderes uncovered a live DoNot APT operation against Bangladesh’s military. The attackers used a fake officer biography to plant a multi-stage implant. Their command servers were still handing out payloads during the analysis.
What happened
A booby-trapped biography
The lure looked harmless. It arrived as an RTF file named after a senior Bangladesh Air Force officer. The target expected a biography. Instead, opening the file started a hidden infection chain. The document carried no macros of its own. Rather, it fetched one from an attacker server through remote template injection. Cyderes says the RTF “uses remote template injection to fetch a VBA macro.” A geofencing check then gated delivery. Only victims inside the target region received the weaponized template. Everyone else, including sandboxes and researchers, got a clean decoy.
A chain of hidden loaders
Once the macro ran, it injected shellcode into the host process. The code matched the system’s 32-bit or 64-bit build. Next, the shellcode moved through several XOR-encoded stages. Each stage pulled the next from the same server. To blend in, the files posed as .ico, .mp3, and .doc downloads. The final stage dropped a DLL implant. That implant ran through rundll32.exe from a single export. It also decrypted its settings with a hardcoded AES-128-CBC key. Then it set up a scheduled task disguised as OneDrive telemetry. Finally, it profiled the host and beaconed to a second server over encrypted HTTPS.
Pulling a live payload from the C2
The team did not stop at static analysis. Instead, they crafted a request to the payload endpoint directly. The server answered and delivered a second-stage DoNot module named ejtest.dll. This proved the command server was live, not archived. In short, real victims were still in line for follow-on tools. The implant even wiped its own file with a delayed self-delete command to reduce forensic traces.
Who is behind the DoNot APT
Cyderes attributes the campaign to the DoNot APT, also tracked as APT-C-35, with high confidence. Several vendors assess this group as India-aligned. It has run espionage operations across South Asia since at least 2016. Its usual targets include government, military, and diplomatic bodies in Pakistan, Bangladesh, and Sri Lanka. The attribution here rests on hard technical overlap. The retrieved module’s AES key matched documented DoNot samples byte for byte. Matching C2 URL paths and beacon formats strengthened the link. Therefore, the evidence points to shared DoNot tooling rather than a copycat.
Impact and scale
This is not a dormant test setup. The team retrieved a real follow-on module from the running server. As a result, victims were receiving fresh payloads during the investigation. The targeting stays narrow and deliberate. Tailored lures and regional geofencing point to focused intelligence collection. Bangladeshi defence staff sit squarely in the crosshairs. Moreover, the overlap with past DoNot work signals a sustained threat across South Asia.
What comes next and how to stay protected
So far, no arrests have surfaced. The operators may keep rotating their domains. Therefore, defenders should act on the published indicators quickly. Cyderes urges teams to hunt for specific traffic and persistence signs.
Detection tips
Start with outbound HTTPS POST traffic. Flag requests that carry the mopd= and malp= parameters. Watch for scheduled tasks that spoof OneDrive naming. Also check DNS queries to misspelled .info domains. Treat RTF files that fetch remote templates as suspect. When in doubt, block the document and alert your security team.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
