Cosmic Leopard, Operation Celestial Force

About Cosmic Leopard, Operation Celestial Force.

It is still active today, employing the use of GravityRAT, an Android-based malware, along with a Windows-based malware loader we track as “HeavyLift.” All GravityRAT and HeavyLift infections are administered by a standalone tool we are calling “GravityAdmin,” which carries out malicious activities on an infected device. Analysis of the panel binaries reveals that they are meant to administer and run multiple campaigns at the same time, all of which are codenamed and have their own admin panels. This multiyear operation continuously targeted Indian entities and individuals likely belonging to defense, government and related technology spaces. The tactics, techniques, tooling and victimology of Cosmic Leopard contain some overlaps with those of {{Transparent Tribe, APT 36}}, another suspected Pakistani APT group, which has a history of targeting high-value individuals from the Indian subcontinent. However, we do not have enough technical evidence to link both the threat actors together for now, therefore we track this cluster of activity under the “Cosmic Leopard” tag.