Loading story…
Pakistan-linked threat actor Transparent Tribe (APT36) has launched a targeted cyberespionage campaign against Indian government organizations, focusing on systems running the Bharat Operating System Solutions (BOSS) Linux distribution. The attackers used spear-phishing emails containing malicious ZIP archives or links to cloud-hosted files, which, when opened, executed a Bash command sequence to deploy the Golang-based DeskRAT malware. The campaign, observed since June 2025, leverages decoy PDFs related to Indian defense matters and employs multiple Linux-specific persistence mechanisms, including systemd services, cron jobs, autostart directory entries, and modifications to .bashrc.
DeskRAT establishes command-and-control via WebSockets, enabling remote file browsing, data exfiltration of files under 100 MB, and the ability to upload and execute additional payloads. Notably, the malware incorporates code potentially generated by large language models, accelerating its development and deployment. Researchers highlight that this use of AI tools by attackers is compressing malware development cycles, making detection and response more challenging for defenders. The campaign underscores the evolving sophistication of APT36 and the growing threat to Linux-based government infrastructure in India.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Multiple security outlets reported on a newly identified Transparent Tribe campaign targeting Indian government and BOSS Linux systems, attributing the activity to the Pakistan-linked group and detailing the use of DeskRAT malware. The public reporting consolidated findings on the phishing methods, malware capabilities, and targeting focus.
During August and September 2025, researchers observed Transparent Tribe deploying evolving DeskRAT variants, including AI-assisted and cross-platform tooling such as Linux- and Windows-capable components, with anti-analysis and payload delivery features. Reporting linked the activity specifically to attacks on India's BOSS Linux environment.
Transparent Tribe (APT36), a Pakistan-linked threat actor, conducted spear-phishing attacks against Indian government targets using malicious ZIP attachments and cloud-hosted links to deliver the Golang-based DeskRAT malware. The campaign targeted BOSS Linux systems and used WebSocket-based command-and-control, persistence mechanisms, and remote access capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using `mshta.exe`, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions. Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Jun 29, 2026
**Transparent Tribe (APT36)**, a Pakistan-aligned threat actor historically associated with espionage against Indian government, defense, and education targets, has been observed expanding operations into **India’s startup ecosystem**, with a particular focus on startups connected to **cybersecurity, intelligence, and law-enforcement support**. Researchers reported the activity after identifying suspicious, India-origin uploads and startup-themed lure material, including the apparent use of personal details tied to a real startup founder to increase the credibility of spear-phishing content. The intrusion chain described relies on **spear-phishing emails** delivering an **ISO container** (e.g., `MeetBisht.iso`) that includes a **malicious LNK shortcut** masquerading as a legitimate document (such as an Excel file) plus a hidden folder containing a **decoy document**, a **batch script** to execute/maintain the infection flow, and the **Crimson RAT** payload (disguised as an executable named like *Excel*). Once installed, **Crimson RAT** enables broad surveillance and control capabilities (e.g., screen monitoring, audio recording, file theft, and system control), aligning with APT36’s established intelligence-collection objectives even as targeting broadens to startup-linked individuals with proximity to sensitive government or security operations.
Jun 29, 2026
Transparent Tribe (`APT36`), a suspected Pakistan-aligned threat actor, targeted India’s education sector with malicious Microsoft Office documents designed to deliver **Crimson RAT**. Researchers said the campaign used both traditional macro-enabled files and a newer `OLE` embedding technique that tricks victims into double-clicking a fake **"View Document"** prompt, launching the malware under the filename `MicrosoftUpdate.exe`. SentinelOne identified multiple **Crimson RAT** `.NET` variants compiled between July and September 2022 that used the command-and-control domain `richa-sharma.ddns[.]net`. The samples showed anti-analysis delays, persistence checks, and differing obfuscation approaches, including **Eazfuscator**, indicating continued tool refinement as the group broadened its targeting beyond Indian military and government entities to include educational institutions and students across the subcontinent.
Jul 12, 2026