Sloppy Lemming
Sloppy Lemming is a threat actor group with an ideological motive, tracked by Brandefense. It targets the Government sector in 5 countries, including China and Türkiye. It uses 30 MITRE ATT&CK techniques.
- Outrider Tiger
- Fishing Elephant
- Techniques
- 30
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
30 techniques across 9 of 14 tacticsArsenal · Malware And Tools.
- Ares RATmalware
- BadPawmalware
- BoryptGrabmalware
- BurrowShellmalware
- CRYPTSP.dllmalware
- MeowMeowmalware
- Rust-based RATsmalware
- Rust-based Remote Access Trojan (RAT)malware
- side-channel-weakmapmalware
- StegaBinmalware
- WarHawkmalware
- Cloudflare Workerstool
- CloudPhishtool
Campaigns.
- SloppyLemming campaignJan 2022 to Jan 2026
About Sloppy Lemming.
SloppyLemming is an advanced actor that uses multiple cloud service providers to facilitate different aspects of their activities, such as credential harvesting, malware delivery and command and control (C2). This actor conducts extensive operations targeting Pakistani, Sri Lanka, Bangladesh, and China. Industries targeted include government, law enforcement, energy, telecommunications, and technology entitie.
Last updated Nov 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.