Image by vecstock, from Unsplash
European Foreign Ministry Hit By DoNot APT Cyber-Espionage Attack
Reading time: 2 min
Last Updated: Jul 11, 2025
-
![Kiara Fabbri]()
-
![Sarah Frazier]()
Fact-Checked by Sarah Frazier Content Manager
The hacker group DoNot APT performed a secretive cyberattack against a European foreign ministry, using fake emails and malware which demonstrated the advancement of worldwide espionage tactics.
In a rush? Here are the quick facts:
- Attack began with a phishing email impersonating defense officials.
- Malware disguised as a PDF was delivered via Google Drive.
- Malware steals data and maintains access using scheduled tasks.
The cyber-espionage group DoNot APT, known as APT-C-35 or Mint Tempest, conducted a covert cyberattack against a European foreign ministry, as Trellix research shows. Since 2016, the espionage group operating from India has focused on South Asian government targets and diplomatic institutions, but now appears to be expanding into Europe.
The email, with the subject line “Italian Defence Attaché Visit to Dhaka, Bangladesh,” contained a malicious Google Drive link. Clicking the link downloaded a password-protected document but contained malware.
Once opened, the malware, disguised as a PDF, quietly installed a backdoor on the victim’s system. After gaining access, the attackers began stealing sensitive data by running tasks which refreshed the malware every 10 minutes. Since 2018, DoNot APT has used LoptikMod as its exclusive malware tool.
The researchers observed that the attackers employed a technique which embedded malicious code within binary strings, which made the malware detection more challenging. The malware steals personal system information through its encryption protocol to send it to a command-and-control server that researchers found inactive at the time of analysis, likely to evade detection.
The experts recommend that governments and organizations must enhance email protection mechanisms, monitor network activity, and implement signature-based malware blocking and employee training for phishing identification.
Previous Story
Latest articles 
