Loading malware…
GOGITTER is a previously undocumented 64-bit Golang downloader used in Zscaler ThreatLabz’s “Gopher Strike” intrusion chain targeting Indian government entities, assessed with medium confidence to be Pakistan-linked (tactics resembling APT36/Transparent Tribe, possibly a subgroup/parallel actor). Initial access is via spear-phishing emails with PDF attachments that present a fake Adobe Acrobat update prompt; clicking “Download and Install” retrieves an ISO payload. Delivery is gated server-side to only return the ISO when the requester appears to be in India (IP geolocation) and uses a Windows User-Agent, likely to evade automated analysis.
On execution, GOGITTER searches for a VBScript file named windows_api.vbs in C:\Users\Public\Downloads, C:\Users\Public\Pictures, and %APPDATA%. If absent, it creates the script (plaintext VBScript embedded in the binary) in the first accessible location. The dropped windows_api.vbs polls attacker infrastructure every 30 seconds and executes returned VBScript when the response begins with "hi ". The script uses a hardcoded Chrome User-Agent and additional HTTP headers. Persistence is established via a scheduled task named MicrosoftEdge_ConfigurationUpdate_<random 4 digits> that runs windows_api.vbs every 50 minutes.
GOGITTER also checks for adobe_update.zip in the same directories; if missing, it downloads the ZIP from a private, token-protected GitHub repository (hxxps[:]//raw.githubusercontent[.]com/jaishankai/sockv6/main/adobe_update.zip) using an embedded GitHub authentication token. It extracts the ZIP and drops edgehost.exe (identified as the GITSHELLPAD Golang backdoor) plus a zero-byte text file into an installation folder. GOGITTER then issues an HTTP GET to adobe-acrobat[.]in/ninevmc987.php?file=bncoeeav34564cvv94adfavc3354334dfsf, likely as an infection signal.
Associated/related tooling in the same campaign includes GITSHELLPAD (GitHub REST API/private-repo C2 with command.txt/result.txt workflow) and GOSHELL (custom Golang loader that ultimately injects/executes a stageless Cobalt Strike Beacon). High-confidence IOCs directly tied to GOGITTER’s behavior include: windows_api.vbs; scheduled task MicrosoftEdge_ConfigurationUpdate_<4 digits>; C2 URLs hxxps[:]//govt-filesharing[.]site/hpc5985.php?key=xvnd54&info=Hello<ComputerName> and hxxp[:]//ingov.myartsonline[.]com/hpc5985.php?key=xvnd54&info=Hello<ComputerName>; GitHub ZIP URL hxxps[:]//raw.githubusercontent[.]com/jaishankai/sockv6/main/adobe_update.zip; and the infection-signal URL adobe-acrobat[.]in/ninevmc987.php?file=bncoeeav34564cvv94adfavc3354334dfsf.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Golang-based downloader/loader delivered via a fake Adobe Acrobat Reader DC update (ISO). It establishes persistence using scheduled tasks and retrieves additional scripts and payloads from GitHub repositories.
Golang downloader/loader used in the 'Gopher Strike' campaign; initiates execution, pulls additional archives/payloads from attacker infrastructure (via curl), and facilitates staging of subsequent tools including backdoors and Beacon.
Golang downloader/loader used in the Gopher Strike campaign to fetch and unpack additional payloads (RAR archives) and facilitate follow-on execution.
Golang-based downloader used in APT36 infection chains to retrieve and execute additional payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.