ReadOnly

ReadOnly is a malware component used in a cyber-espionage campaign attributed to APT36 (Transparent Tribe), a Pakistan-aligned threat actor. In the reported campaign, spear-phishing emails delivered a ZIP archive containing a malicious file disguised as a PDF; when opened, it deployed two malware components, ReadOnly and WriteOnly. ReadOnly is described as enabling remote control of infected systems, data exfiltration, and persistent surveillance. Reported capabilities include capturing screenshots, monitoring clipboard activity, enabling remote desktop access, and maintaining access on victim machines. The malware is also described as quietly embedding itself on compromised hosts and adjusting its behavior based on the antivirus software installed. The campaign targeted Indian government, academic, and strategic institutions and was assessed as aligned with intelligence-gathering objectives rather than financial gain. Cyfirma reported that the activity reflected APT36’s evolving tradecraft, including abuse of trusted Windows components and fileless execution techniques. A noted risk from the clipboard-monitoring functionality is theft or overwriting of copied data, including potential hijacking of cryptocurrency transactions.