BabShell

BabShell is a C++ reverse shell used by the Mysterious Elephant APT in cyber-espionage campaigns targeting government entities and foreign affairs sectors in South Asia and the broader Asia-Pacific region, with reported focus on Pakistan, Afghanistan, Bangladesh, Nepal, India, and Sri Lanka. In the early 2025 campaign described in the source material, initial access was obtained through exploit kits, phishing emails, and malicious documents, after which a PowerShell script dropped BabShell onto compromised systems. BabShell enables attackers to connect to infected hosts, collects system information including username, computer name, and MAC address, executes attacker commands in separate threads, writes command results to files named in the format output_[timestamp].txt, and exfiltrates the output to command-and-control infrastructure. The malware is described as part of a broader toolchain used by Mysterious Elephant alongside MemLoader modules. Specifically, BabShell was reported to launch MemLoader HidenDesk, an in-memory loader that can execute a Remcos RAT payload, and MemLoader Edge, another loader that embeds a vxRat-derived backdoor referred to as VRat. The surrounding campaign objective included theft of sensitive data, including WhatsApp Desktop-shared files and Chrome browser data via other associated exfiltration modules. The provided content does not include BabShell-specific hashes or network indicators.