kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · IN

QUILTED TIGER

also tracked as dropping elephant 2, sidecopy 1

2 stories · 2 in the wild · June 19, 2026 – June 21, 2026

evidence: 2 observed

how they got in

  • phishing email 2 · Jun 21

geography

  • china 2 · Jun 21
  • pakistan 1 · Jun 19

malware and tools

  • dropping elephant 1 · Jun 21

techniques

  • code execution 1 · Jun 21
  • obfuscation 1 · Jun 21
  • lnk loader 1 · Jun 19

attack phases seen

  • Execution 2 · Jun 21
  • Initial access 2 · Jun 21

what we reported, newest first, grouped by story

Jun 19 – June 21, 2026 · 2 reports

  • Rapid7 detailed Dropping Elephant delivering an in-memory RAT via a China-themed loader chain; Nextron tied 44 samples to one continuous LNK-loader line spanning May 2023 to June 2026, each a shortcut posing as a PDF that fires a hidden PowerShell stager with sandbox/debugger checks before self-deleting (Nextron). · Jun 21 · observed · via phishing email · as dropping elephant · Threat Intelligence
  • Dropping Elephant has run one continuous China-themed LNK loader line for three-plus years (44 samples, 2023–2026) delivering an in-memory RAT via PDF-masquerading shortcuts and hidden PowerShell stagers (Rapid7, Nextron); SideCopy (APT36) swapped in a "Minutes Of Meeting" double-extension .lnk lure dropping a .NET RAT with HKCU Run persistence (Nextron). · Jun 19 · observed · via phishing email · as dropping elephant, sidecopy · Nation-State & APT