Do Son The DoNot APT hit Bangladesh military targets with a fake officer biography. Cyderes traced a live, multi-stage implant to active C2 servers.
Bangladesh
Threat actor uses React2Shell to deploy Sliver C2 on FortiWeb devices, using a Bangladesh Airforce decoy to target govt and financial sectors.
SikkahBot, a new Android malware, is impersonating scholarship apps to steal financial data and automate transactions from students in Bangladesh.
McAfee warns of a new Android malware campaign targeting Bangladeshi expats with fake remittance apps like TapTap Send, stealing personal and financial data, including photo IDs.