Threat actors from a newly discovered threat organization, tracked as Clasiopa, have been targeting research laboratories throughout Asia. Little is known about this threat group, however, recent activity hints at threat actors utilizing brute force methods on public-facing infrastructure as their intrusion method. Additional tactics and techniques of Clasiopa includes checking IP addresses through a singular domain, attempting to disable anti-virus solutions, deployment of numerous malicious backdoors to gather file listings and exfiltrate data, and deletion of operating system event logs. Malicious programs often deployed in Clasiopa include a customized remote access trojan (RAT) dubbed “Atharvan”, a modified “Lilith” RAT for remote command execution, a command-and-control (C2) tool called Thumbsender for file exfiltration, and customized proxy scripts. Clasiopa hasn’t been officially tied to any one nation, however based on some of the malicious programs the group utilizes and an encrypted ZIP archive with the password “iloveindea1998^_^” suggests an Indian influence. Furthermore, the command-and-control (C2) nodes utilized within the malware point to servers hosted out of South Korea, an uncommon location for these types of servers to communicate to. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.