Loading malware…
GITSHELLPAD is a previously undocumented 64-bit Golang backdoor observed by Zscaler ThreatLabz in the “Gopher Strike” intrusion chain targeting Indian government entities (first observed September 2025; ongoing as of late January 2026). The campaign is attributed with medium confidence to a Pakistan-linked threat actor, with tradecraft resembling APT36/Transparent Tribe but possibly a new subgroup/parallel actor.
Infection chain context: victims receive spear-phishing emails with PDF attachments that present a fake Adobe Acrobat update prompt. Clicking “Download and Install” retrieves an ISO payload, with server-side delivery gated to India-based IP geolocation and a Windows User-Agent check. The ISO drops a Golang downloader (GOGITTER) that establishes persistence via a scheduled task and retrieves additional payloads from a private, token-protected GitHub repository (e.g., adobe_update.zip from raw.githubusercontent.com/jaishankai/sockv6). GOGITTER extracts and drops edgehost.exe, identified as GITSHELLPAD.
Capabilities/behavior: GITSHELLPAD uses threat-actor-controlled private GitHub repositories as its command-and-control channel via GitHub’s REST API (Contents API). It creates a per-host directory in the repo named SYSTEM-<hostname> and writes an info.txt file containing Base64-encoded host identification. It polls for commands by repeatedly requesting command.txt (reported polling every 15 seconds; retry logic includes faster retries on connectivity failure and when command.txt is empty). It Base64-decodes received tasking and supports commands including cd, run, upload, download, and default execution via cmd /c with output capture. It writes execution output/status to result.txt and uploads it back to GitHub via HTTP PUT, then deletes command.txt after execution. ThreatLabz observed extensive post-compromise operator activity (200+ commands) including reconnaissance, downloading additional tools/archives, cleanup, process killing, and archive extraction (e.g., tar).
Associated infrastructure/IOCs mentioned in reporting (campaign-level): private GitHub repos used for payload/C2; download URL hxxps[:]//raw.githubusercontent[.]com/jaishankai/sockv6/main/adobe_update.zip; infection-signal URL adobe-acrobat[.]in/ninevmc987.php?file=bncoeeav34564cvv94adfavc3354334dfsf. (Note: additional VBScript C2 URLs and Cobalt Strike infrastructure are described in the same intrusion chain but are not intrinsic to GITSHELLPAD itself.)
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor payload retrieved by the GOGITTER downloader from GitHub repositories, used to provide ongoing access to compromised systems.
Golang backdoor used in the Pakistan-linked 'Gopher Strike' campaign; uses GitHub private repositories (issues/comments/commits) as command-and-control and for exfiltrating command output.
Custom Golang backdoor using GitHub (private repos/issues/commits) as command-and-control and exfiltration channel to blend with legitimate GitHub API traffic.
Golang-based backdoor that leverages GitHub for command-and-control (C2) in APT36 campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.