AISEC > Security News > Malware > SloppyLemming Malware Attacks Pakistan Bangladesh Government 2025
March 03, 2026 #malware Source: The Hacker News 3 min read · 606 words

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

SloppyLemming атакує уряди Пакистану та Бангладеш, використовуючи подвійні ланцюги малвару

SloppyLemming's Year-Long Assault on South Asian Governments

Okay, so here's what keeps me up at night: a threat group called SloppyLemming has been systematically hammering government agencies and critical infrastructure across Pakistan and Bangladesh for over a year. We're talking about an active malware campaign that's been running from January 2025 through at least early 2026. That's roughly 15 months of sustained, targeted attacks.

The Hacker News reported this week that SloppyLemming deployed two distinct attack chains—each delivering different payloads designed to infiltrate government systems. This isn't spray-and-pray malware. This is deliberate, organized, and specifically calibrated for these targets.

Breaking It Down

Let's be clear about what makes this campaign different. SloppyLemming isn't using a single malware family. They're running dual attack chains, which suggests a level of operational sophistication that goes beyond script kiddies testing exploits. The group deployed BurrowShell in one attack vector and a newly identified Rust-based malware in another.

Why two separate chains?

Redundancy, probably. Flexibility, definitely. If one infection method gets blocked or detected, the second one keeps the operation rolling. It's like having a backup plan for your backup plan—and frankly, it's the kind of thinking you see from groups that've done this before.

The timeline matters too. We're not talking about a flash-in-the-pan attack. Fifteen months of continuous operations against government entities in two countries signals real intent and resources. These aren't nation-state actors necessarily, but they're not working from a coffee shop with a cracked copy of Metasploit either.

The Technical Side

BurrowShell isn't new to the threat landscape, but SloppyLemming's implementation here appears tailored for government infrastructure. It's a shell-type payload—meaning once it lands on a system, it gives attackers command-and-control access to execute additional commands remotely.

The Rust-based malware is the more interesting piece. Rust has become a language of choice for modern malware development because it's harder to reverse-engineer than traditional C/C++ binaries, and it compiles down to efficient machine code that's trickier for security analysts to dissect. The fact that SloppyLemming went to the trouble of building Rust malware tells you they're thinking about evasion and longevity.

Attack chains in this context aren't just single-stage exploits. They're sequences: gain initial access, establish persistence, escalate privileges, move laterally through networks, exfiltrate data.

Who's Affected

The targets here are specifically government entities and critical infrastructure operators in Pakistan and Bangladesh. This is geopolitically significant. Pakistan faces documented climate vulnerability—the pakistan climate vulnerability index 2025 shows the country ranks among the most climate-vulnerable nations globally, dealing with ongoing infrastructure strain from environmental pressures. Bangladesh sits in a similar situation. Critical infrastructure systems managing water resources, power distribution, and emergency services are exactly what you'd want to compromise if you're looking for maximum .

When attackers target government networks in climate-vulnerable regions, they're not just stealing data. They're potentially disrupting systems that manage disaster response, resource allocation, and public health coordination.

What To Do Now

If you're in Pakistan or Bangladesh government or critical infrastructure, you should assume your network has been probed by now. Network segmentation becomes critical—isolate your most sensitive systems from general employee networks. Implement proper logging and monitoring on every system that handles government functions. Look for BurrowShell signatures and any unusual Rust binaries that appeared between January 2025 and today.

But here's the broader point: this campaign reveals a gap in regional cyber defense capabilities. SloppyLemming operated openly for over a year across two countries. That's not because the malware was invisible—it's because detection and response infrastructure wasn't there or wasn't coordinated. International cooperation on attribution and intelligence sharing would help, but that requires investment Pakistan and Bangladesh haven't prioritized yet. Start there.

Read original article →

// FAQ

What is BurrowShell malware and what does it do?

BurrowShell is a remote access shell payload that gives attackers command execution capabilities on infected systems. Once deployed, it allows threat actors to run arbitrary commands and maintain persistent access to government infrastructure.

Is this a pakistan cyber attack specifically targeting government?

Yes, SloppyLemming specifically targeted Pakistan government entities and critical infrastructure alongside Bangladesh targets between January 2025-2026. Pakistan's climate vulnerability and reliance on critical infrastructure systems made it a likely target.

How long has SloppyLemming been attacking Pakistan and Bangladesh?

The campaign has been active for approximately 15 months, spanning from January 2025 through at least March 2026, suggesting an ongoing, sustained threat rather than a one-off attack.

// RELATED

#malware Who is the Kimwolf Botmaster “Dort”? 2026-02-28 #malware Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience 2026-02-27 #malware Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor 2026-02-27

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →