Confucius is an India-linked advanced persistent threat group focused on cyber espionage, active since at least 2013. The group primarily targets military personnel, government organizations, nuclear authorities, and energy sectors in South Asia, particularly in neighboring countries like Pakistan and China. Confucius is often noted for its use of social engineering tactics, including fake chat applications and romance scams, to deliver its malware. The group has shown an evolution in its operational model, shifting from simpler information stealers to more modular and advanced backdoors, while maintaining a consistent focus on intelligence gathering for its suspected state sponsor. The group operates under the name Confucius, though it has also been referred to as Confucious and by its MITRE ATT&CK ID G0142. It is sometimes noted for similarities with the Patchwork group, though they are generally considered distinct entities.