Operation Celestial Force employs mobile and desktop malware to target Indian entities
Summary: Cisco Talos assesses with high confidence that a nexus of Pakistani threat actors it tracks as Cosmic Leopard has run Operation Celestial Force since at least 2018, targeting entities in the Indian subcontinent with Windows and Android malware. The operation uses GravityRAT (Windows, later ported to Android around 2019), the HeavyLift Electron-based loader, and custom GravityAdmin panel binaries, with the earliest panel compiled in August 2021 and malicious websites registered as late as early January 2024.
Why it matters: A campaign running continuously since at least 2018, with malware variants still being distributed through sites registered in January 2024, shows an adversary that has sustained access and tooling development for roughly six years against the same victim population.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026