Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage

By Brian Hussey, Senior Vice President of Howler Cell Threat Services at Cyderes 

Cyber espionage campaigns are designed to succeed long before malware is even deployed. They often begin with sophisticated tactics such as social engineering and spear phishing, using trusted identities, timely events or convincing documents to infiltrate an environment undetected.  

The recent DoNot (APT-C-35) campaign targeting Bangladesh’s military is a prime example. The attackers didn’t rely on a generic lure since that would immediately raise suspicion.

Instead, they used a document presented as the biography of a real Bangladeshi Air Force officer. To the recipient, there was nothing immediately unusual about this correspondence. 

The attackers were relying on more than technical sophistication. They were counting on trust. The opening of the document was followed by a persistent, carefully crafted attack designed to remain just as convincing as the lure that delivered it. 

Designing Each Stage to Blend In

At first glance, there was nothing obviously malicious about the file. Instead of embedding the final payload directly in the document, the attackers used remote template injection to fetch malicious content from an attacker-controlled server at runtime.

Because the document itself contained no executable code or OLE macro-objects, it was able to evade static analysis tools and email gateway scanners. 

Once the fetched macro executed, it injected architecture-aware shellcode through callback-based API abuse. The shellcode then progressed through several XOR-encoded stages, each retrieved from the same command-and-control domain using benign-looking file extensions.

The final stage delivered a DLL implant that established persistence through a scheduled task disguised as OneDrive telemetry, profiled the host, and sent AES-128-CBC encrypted payloads over HTTPS to a second C2 server. 

This layered approach wasn’t accidental. Every stage was designed to blend in with legitimate system activity, delaying the delivery of the final payload and reducing opportunities for detection. 

Live Campaign Interactions

Researchers traditionally examine the malware that successfully runs on a victim’s machine to understand how it works and provide attribution to the threat actor or group that carried out the attack.

In this case, analysts went a step further and interacted directly with the campaign’s active infrastructure.

This allowed them to retrieve the second-stage DLL implant, confirm the command-and-control infrastructure was still active, understand how the next stage was delivered, strengthen attribution, and improve detection guidance. 

Since the campaign was still active, researchers didn’t need to reconstruct events after the fact. They were able to observe how the operation unfolded in real time, giving them a much clearer picture of its delivery chain, infrastructure, and defensive opportunities. 

Pattern-Driven Attribution

It is irresponsible to rely on a single piece of evidence for campaign attribution. Analysts are only able to build confidence by comparing many independent artifacts that, together, reveal consistent patterns of activity. 

In the case of DoNot, researchers identified multiple technical similarities to previous campaigns carried out by the group, including identical AES key material, the same URI path structure and POST parameters, matching beacon formats, familiar infrastructure naming conventions, and significant code reuse.

None of those artifacts are definitive in isolation, but when combined, they form a consistent pattern that increases confidence in the attribution. 

Threat actors frequently change infrastructure, domains, and delivery methods. They are much less likely to completely reinvent the tools and techniques that have already proven effective.

Those recurring patterns become some of the strongest indicators researchers have when identifying threat actors and anticipating future campaigns. 

Maintaining Tradecraft Consistency

DoNot has been active for at least a decade. During that time, they have primarily targeted government, defense, and diplomatic organizations aligned with South Asian geopolitical interests.

While the group’s victims have expanded beyond the region in recent years, the underlying tradecraft has remained remarkably consistent. 

The Bangladesh sample, for example, shares its C2 URI path structure, hardcoded AES key and IV, and other implementation details with earlier DoNot campaigns.

That level of code reuse suggests the group relies on a common codebase from one operation to the next rather than developing entirely new tooling each time.

This is welcome news for defenders because detection logic built around recurring cryptographic material, URI structures, and beacon formats often remains useful long after individual domains or servers have been replaced. 

What Defenders Should Watch For

While the group’s infrastructure behavior remains relatively unchanged and serves as one of the most valuable sources of insight, DoNot continues to evolve.

Cybersecurity professionals must monitor how the group is finetuning their targeting to expand into adjacent countries, sectors, and specific roles.

They should also pay close attention to how its delivery techniques change as document-macro and RTF lures become less effective.

Artifacts that are more likely to survive infrastructure changes should be prioritized, including C2 URI path patterns, beacon data, and document delivery techniques. 

Organizations should also take the following steps to shore up defenses: 

• Treat document lures themed around real personnel and current events as a primary attack vector. Named-officer or diplomatic-themed attachments deserve additional scrutiny.

• Disable macros and active content wherever possible. Block or sandbox RTF and Office attachments from external senders.

• Hunt on durable artifacts, not just domains. C2 path structures, beacon behavior, and hardcoded cryptographic values often outlast infrastructure changes.

• Monitor outbound traffic for beacon patterns rather than relying solely on known-bad domain lists, since the group continues rebuilding its infrastructure.

Attackers continuously refine who they target and how they earn trust, but they rarely abandon tradecraft that has proven successful.

That predictability is the defender’s edge. Track the artifacts that persist across campaigns, and each new DoNot operation becomes easier to catch than the last.