Full Report
Contents Introduction Key Targets Industries Affected Geographical focus Geopolitical Context Infection Chain Timeline of Activity Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Malicious Archive Delivery Stage 2 – Malicious Shortcut Execution Stage 3 – HOPPINGANT JavaScript Loader Infrastructure & Attribution Conclusion SEQRITE Protection Indicators of Compromise (IOCs) MITRE ATT&CK Mapping […] The post Operation CamelClone: Multi-Region Espionage Campaign Targets Government and Defense Entities Amidst Regional Tensions appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Incident Report: Operation CamelClone
## Executive Summary
Operation CamelClone is a multi-region cyber-espionage campaign identified in early 2026 targeting government, defense, and diplomatic entities across Algeria, Mongolia, Ukraine, and Kuwait. The campaign utilizes spear-phishing with localized decoy documents and a multi-stage infection chain involving a custom JavaScript loader named "HOPPINGANT." The primary objective is intelligence gathering and data exfiltration from strategic sectors amidst heightened regional geopolitical tensions.
## Incident Details
- **Discovery Date:** February 24, 2026
- **Incident Date:** February – March 2026
- **Affected Organization:** Multiple government and defense entities
- **Sector:** Government, Defense, Foreign Affairs, Energy
- **Geography:** Algeria, Mongolia, Ukraine, Kuwait
## Timeline of Events
### Initial Access
- **Date/Time:** Late February 2026
- **Vector:** Spear-phishing via email
- **Details:** Delivery of malicious archives (ZIP) containing LNK files disguised as official documents (e.g., "Ministry of Housing," "Kuwait Air Force requirements").
### Lateral Movement
- **Details:** The report focuses primarily on initial compromise and persistence; however, the HOPPINGANT loader provides capabilities for further tool deployment (legitimate tools like `l.exe`) to facilitate internal reconnaissance.
### Data Exfiltration/Impact
- **Details:** Attackers target local system files and information repositories. Exfiltration is conducted via public anonymous file-sharing platforms (e.g., `filebulldogs[.]com`) to blend with legitimate traffic.
### Detection & Response
- **Detection:** Identified by Seqrite Labs through telemetry and VirusTotal monitoring of malicious LNK/archive patterns.
- **Response:** Analysis of the infection chain, identification of the "HOPPINGANT" malware, and mapping of C2 infrastructure.
## Attack Methodology
- **Initial Access:** Spear-phishing with malicious ZIP attachments (T1566.001).
- **Persistence:** Implementation of local JS loaders and scheduled execution via malicious shortcuts.
- **Defense Evasion:** Use of obfuscated JavaScript (T1027), legitimate binary proxy execution, and hosting payloads on public file-sharing sites to bypass domain reputation filters.
- **Discovery:** System and local file discovery (T1005).
- **Command and Control:** Web-based C2 using HTTPS for infrastructure communication and payload retrieval.
- **Exfiltration:** Exfiltration to cloud storage/file-sharing services (T1567.002).
## Impact Assessment
- **Financial:** Undisclosed; primarily focuses on internal resource costs for incident response.
- **Data Breach:** High potential for loss of sensitive diplomatic communications, military procurement details, and strategic energy policy data.
- **Operational:** Disruption of government administrative workflows due to compromised workstations.
- **Reputational:** High for targeted government agencies, particularly regarding the exposure of military and international cooperation agreements.
## Indicators of Compromise
### File Indicators (SHA-256)
- `1d0ea66d347325902e20a12e1f2f084be45d3d6045264e513dcc420b9928013c` (LNK: Kuwait Air Force)
- `2902cdee050a60c3129b4bb84e74ddda7b129c3473556f689d83609d9a5981a7` (LNK: Mongolia Cooperation)
- `630ac67d8db777ae0b93e066bd13b21908e79f23a41a64448f0a4ea38c063a44` (f.js - HOPPINGANT)
### Network Indicators
- `hxxps://filebulldogs[.]com/uploads/AVQB61TVOX/f.js`
- `hxxps://filebulldogs[.]com/uploads/OKW5RN48ZJ/document.pdf`
- `oliwiagibbons[@]onionmail[.]org`
## Response Actions
- **Containment:** Blocking of C2 domains and file-sharing URLs at the perimeter.
- **Eradication:** Identification and removal of malicious `.lnk` and `.js` files from affected endpoints.
- **Recovery:** Restoration of systems from known-clean backups and credential rotation for targeted users.
## Lessons Learned
- **Thematic Sophistication:** Threat actors are successfully leveraging niche geopolitical developments (e.g., Mongolian-Chinese relations) to create highly convincing lures.
- **Infrastructure Abuse:** The use of public file-sharing sites remains an effective way to bypass traditional legacy security solutions that do not inspect encrypted traffic or block shared-hosting domains.
## Recommendations
- **Technical Controls:** Disable or heavily restrict the execution of `.lnk` files from non-standard directories (e.g., Temp or Downloads).
- **Email Security:** Implement advanced threat protection to scan for anomalous shortcuts/scripts within compressed archives.
- **User Awareness:** Conduct spear-phishing simulations specifically focusing on "official-looking" documents related to current regional news and diplomatic events.
- **Monitoring:** Set alerts for unauthorized PowerShell or WScript/CScript execution following the opening of an archive file.