DoNot Team: The India-Nexus Spies Watching South Asia

DoNot Team (MITRE ATT&CK G0129; also APT-C-35, SectorE02, Viceroy Tiger, Origami Elephant) is a suspected India-nexus espionage group active since at least 2016. Attribution is medium confidence and partly circumstantial: Amnesty International linked supporting infrastructure to the Indian firm Innefu Labs, raising a possible hack-for-hire angle, and a Pakistani government advisory describes the group as Indian state-sponsored. There is no official Indian government confirmation.

Attribution

Suspected India-nexus, assessed at medium confidence. ESET and Kaspersky describe targeting and tooling consistent with India-aligned interests but are careful about naming a sponsor. The Amnesty International / Innefu Labs link is the strongest public thread and points to a possible spyware-vendor or hack-for-hire relationship.

Targeting

Government, military, foreign-affairs ministries, diplomatic entities and embassies, with primary victims in South Asia — Pakistan, Afghanistan, Sri Lanka, Bangladesh and Nepal — plus targets of interest elsewhere. The group works both Windows and Android, including mobile surveillance of specific individuals.

Notable Campaigns

• 2016–present: spear-phishing of South Asian government and military targets using weaponised Office documents that deliver the yty framework.
• 2022: an updated yty/“Jaca” toolkit with Chrome/Firefox credential-stealer modules.
• October 2023: the “Firebird” .NET backdoor against a small set of targets in Pakistan and Afghanistan, with a CSVtyrei downloader (Kaspersky), some code non-functional — suggesting active development.
• January 2025: the “Tanzeem” Android malware disguised as a chat app, abusing the OneSignal push-notification SDK and assessed as targeting specific individuals.

Malware & Tooling

The yty framework (aka Jaca), the earlier EHDevel framework, the Firebird .NET backdoor and CSVtyrei downloader, and Android spyware families including Tanzeem. Delivery is via malicious RTF/Office documents and rogue Android apps.

MITRE ATT&CK Mapping

Detection & Mitigation

• Block and inspect inbound Office documents with macros or remote templates from external senders; enforce Protected View and macro-blocking; prioritise awareness for diplomatic and government staff who are the primary lure targets.
• Monitor for yty/Firebird-style loader behaviour (documents spawning scripting interpreters, scheduled-task creation, browser-credential access) and anomalous HTTP(S) C2 beaconing.
• For mobile fleets, restrict sideloaded APKs, use MDM/mobile threat defence, and scrutinise apps requesting excessive permissions or abusing push-notification SDKs.