Operation Nomad Leopard: Targeted Spear-Phishing Campaign Against Government Entities in Afghanistan

A threat group is targeting Afghan government employees using a fake lure mimicking an official government document. The campaign, named Operation Nomad Leopard, uses a malicious ISO file containing a PDF decoy, LNK file, and the FALSECUB malware. The infection chain involves executing the LNK file to display the PDF and run the malware, which establishes persistence and connects to a command and control server. The malware performs system reconnaissance, file enumeration, and data exfiltration. The threat actor, believed to be regionally focused with low-to-moderate sophistication, uses GitHub for malware distribution and has connections to Pakistan. The campaign demonstrates careful attention to detail in creating convincing lures and leverages legitimate platforms for malicious purposes.

• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operationMalware2026-10-21
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware DistributionCampaign2026-09-22