Threat actors are using a malicious Android installation package and the Spymax RAT variant to target Indian defense personnel. The RAT imitates the Adobe Reader app. The campaign has been going on for more than a year and researchers have still not been able to attribute it to any threat actor. Thus, indicating that this elusive campaign is conducted by a pretty advanced nation state threat actor.