Confucius
- First seen
- 2013-01-01 00:00:00
- Malware type
- spyware
- Family
- Malware family
- Related IoCs
- 2
- Last IoC activity
- 2026-10-10 06:47:44
- Profile updated
- 2026-07-07 13:07:56
Targeted industries: government-and-public-sector media-and-entertainment education-and-nonprofits
Targeted regions: country_code:in country_code:pk country_code:bd
Context
Confucius is a cyber espionage group primarily targeting South Asian countries. It is known for using social engineering techniques to spread its spyware, which is designed to exfiltrate information from targeted industries such as government and media.
Reports & references
- blog.nsfocus.net — Aptconfuciuspakistanibo (report)
- Trend Micro — Confucius Uses Pegasus Spyware Related Lures To Target Pakistani (report)
- uptycs.com — Confucius Apt Deploys Warzone Rat (report)
- Trend Micro — The Urpage Connection To Bahamut Confucius And Patchwork (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Confucius (report)
- researchcenter.paloaltonetworks.com — Unit42 Recent Inpage Exploits Lead Multiple Malware Families (report)
- researchcenter.paloaltonetworks.com — Unit42 Confucius Says Malware Families Get Further By Abusing Legitimate Websites (report)