Operation Nomad Leopard is a spear-phishing campaign targeting Afghan government personnel by distributing a malicious ISO file crafted to mimic official government documents. The ISO contains a PDF decoy to lure victims and a Windows LNK shortcut file that, when executed, opens the PDF to maintain the illusion of legitimacy while simultaneously launching the FALSECUB malware. FALSECUB establishes persistence on the infected system and connects to a command and control (C2) server hosted on dynamic DNS infrastructure (theepad0loc93x.ddns.net) and IP 207.244.230.94. The malware performs extensive system reconnaissance, enumerates files, and exfiltrates sensitive data back to the attacker. The infection chain leverages social engineering (T1566.001) and uses legitimate platforms such as GitHub for malware hosting, complicating detection efforts. The threat actor exhibits low-to-moderate sophistication, focusing regionally with ties to Pakistan. The campaign uses multiple MITRE ATT&CK techniques including T1033 (System Owner/User Discovery), T1204.002 (User Execution: Malicious File), T1497.001 (Virtualization/Sandbox Evasion), T1082 (System Information Discovery), T1020 (Automated Collection), T1083 (File and Directory Discovery), T1553.005 (Subvert Trust Controls: Code Signing), T1041 (Exfiltration Over C2 Channel), T1547.001 (Boot or Logon Autostart Execution), T1573 (Encrypted Channel), T1059.003 (Command and Scripting Interpreter: Windows Command Shell), T1485 (Data Destruction), T1070.004 (Indicator Removal on Host), T1071.001 (Application Layer Protocol), and T1086 (PowerShell). The campaign is not known to exploit software vulnerabilities but relies on user interaction and social engineering to succeed.

For European organizations, the direct impact of Operation Nomad Leopard is currently limited due to its regional targeting of Afghan government entities. However, the campaign’s use of common Windows features (ISO files, LNK shortcuts) and social engineering tactics means that similar spear-phishing attempts could be adapted against European government or diplomatic entities, especially those with interests or operations related to Afghanistan or South Asia. Successful infection could lead to significant confidentiality breaches through data exfiltration, loss of sensitive government information, and potential compromise of internal networks. The use of legitimate platforms like GitHub for malware hosting complicates detection and response. Additionally, the malware’s persistence and reconnaissance capabilities could facilitate long-term espionage or sabotage. European organizations involved in international diplomacy, defense, or foreign aid might be at increased risk if threat actors expand targeting or reuse tactics.

1. Implement strict email filtering and attachment handling policies to block or quarantine ISO files and suspicious LNK files, especially those purporting to be official documents. 2. Conduct targeted user awareness training focusing on spear-phishing risks, emphasizing the dangers of opening unexpected ISO attachments and executing LNK files. 3. Employ endpoint detection and response (EDR) solutions capable of detecting suspicious LNK execution and persistence mechanisms associated with FALSECUB malware. 4. Monitor network traffic for connections to known malicious domains and IPs such as theepad0loc93x.ddns.net and 207.244.230.94, and block or investigate such communications. 5. Use application whitelisting to restrict execution of unauthorized scripts and binaries, including PowerShell scripts used by the malware. 6. Regularly audit and harden systems to detect and remove persistence mechanisms. 7. Leverage threat intelligence feeds to update detection signatures with the provided file hashes and indicators of compromise. 8. Limit use of dynamic DNS services and monitor for suspicious domain registrations related to organizational assets. 9. Enforce multi-factor authentication and least privilege principles to reduce impact if credentials are compromised. 10. Establish incident response plans tailored to targeted spear-phishing and data exfiltration scenarios.