Nation-state APTEspionage
Lancefly
Lancefly is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government and Manufacturing.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
About Lancefly.
The Lancefly advanced persistent threat (APT) group is using a custom-written backdoor in attacks targeting organizations in South and Southeast Asia, in activity that has been ongoing for several years. Lancefly’s custom malware, which we have dubbed Merdoor, is a powerful backdoor that appears to have existed since 2018. The motivation behind both these campaigns is believed to be intelligence gathering.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.