Confucius

Confucius is a threat actor primarily known for conducting cyberespionage campaigns against Pakistan since 2013. This group has been linked to various malicious activities, including the use of novel Android spyware Hornbill and SunBird to scrape call logs and WhatsApp messages of government authorities in Pakistan and Kashmir. The group's activities have been associated with the India-Pakistan conflict, and some reports suggest an alignment with Indian interests. Notably, Confucius was also implicated in targeting UK legislators pushing for stricter legislation against China. In 2022, BBC Monitoring and CASM Technology conducted an analysis of 691 international social media accounts used by China’s ambassadors, consular officials, the Ministry of Foreign Affairs (MFA), and Confucius Institutes. They found variations in the content pushed toward different regions. The Confucius Institutes, established as an arm of China's propaganda machine, aim to spread Mandarin Chinese language worldwide. By 2022, Georgia already hosted three such institutes, with the first one established at the Free University of Tbilisi in 2010. During investigations into attacks in 2023, a new threat actor named Mysterious Elephant was discovered. This group uses a set of malware families previously associated with other known threat actors, such as SideWinder and Confucius. According to cybersecurity firm Kaspersky and Knownsec 404 Team, Mysterious Elephant shares tooling and targeting overlaps with other actors like SideWinder, Patchwork, Bitter, and Confucius, most of which are assessed to be aligned with India. However, Mysterious Elephant exhibits a unique set of tactics, techniques, and procedures (TTPs), setting them apart from these other groups.