Security provider Symantec sent a threat intelligence report to its clients in July 2017. The report proposes the possibility of a nation-state actor, but it doesnt name a state as the guilty party. To install the malware, the attackers used decoy documents related to security issues in South Asia. To infect a computer, the campaign relies on Ehdoor. This trojan opens a backdoor and allows its handlers to upload and download files, take screenshots, and log keystrokes. The malware was also being used to target Android devices.”]
Source: https://grahamcluley.com/spyware-deployed-state-sponsored-attacks-india-pakistan/