Fishing Elephant
Aliases: Outrider Tiger
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:48:43
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:bd country_code:pk country_code:tr country_code:ua country_code:cn
Context
Fishing Elephant is a threat actor that primarily targets victims in Bangladesh and Pakistan. They rely on consistent TTPs, including payload and communication patterns, while occasionally incorporating new techniques such as geo-fencing and hiding executables within certificate files. Their tool of choice is AresRAT, which they deliver through platforms like Heroku and Dropbox. Recently, they have shifted their focus to government and diplomatic entities in Turkey, Pakistan, Bangladesh, Ukraine, and China.
Related threat objects
- SloppyLemming (threat-actor)
Reports & references
- bsi.bund.de — Aktive Apt Gruppen Node (report)
- Kaspersky — 106351 (report)
- Kaspersky — 96826 (report)