LoptikMod

LoptikMod is malware used by the DoNot APT group that primarily targets South Asian countries including Pakistan, Bangladesh, and Sri Lanka to conduct cyber-espionage activities against government agencies, defense and military, diplomatic sector, and important business figures. The group has dual-platform attack capabilities for Windows and Android, often using PDF document decoys, malicious Office documents with macro code, and EXE files disguised as PDF documents. They employ sophisticated attack chains including phishing links, scheduled tasks for persistence, and AES encryption for data exfiltration.