Loading story…
Security researchers reported Pakistan-linked threat activity targeting Indian government entities in campaigns dubbed Gopher Strike and Sheet Attack, assessed with medium confidence to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to APT36. Sheet Attack uses legitimate services including Google Sheets, Firebase, and email for command-and-control (C2), while Gopher Strike begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an Adobe Acrobat Reader DC update.
In Gopher Strike, clicking the “Download and Install” lure triggers delivery of an ISO payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, GOGITTER, which creates a VBScript (e.g., windows_api.vbs) in common directories (including C:\Users\Public\Downloads, C:\Users\Public\Pictures, and %APPDATA%) to poll for instructions and retrieve additional payloads, including GITSHELLPAD, which is described as leveraging private GitHub repositories (with embedded authentication tokens) for staging/persistence and follow-on access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz disclosed the two campaigns publicly, detailing their targeting of Indian government entities and their abuse of legitimate services such as GitHub, Google Sheets, and Firebase for command-and-control. The report also noted that Sheet Attack was less fully described but involved distinct tradecraft from Gopher Strike.
After the ISO was executed, the attackers deployed custom Golang tools including GOGITTER as a downloader, GITSHELLPAD as a GitHub-based backdoor, and GOSHELL as a loader. The malware established persistence, polled private GitHub repositories for tasking, and ultimately loaded Cobalt Strike Beacon while using evasion techniques such as hostname checks and file-size inflation.
In the Gopher Strike intrusion chain, victims received phishing emails with PDF lures impersonating government communications that displayed a fake Adobe Acrobat Reader DC update prompt. The prompt led targets in India using Windows systems to download a malicious ISO, helping the attackers narrow deployment and evade analysis.
Zscaler ThreatLabz first detected two previously undocumented campaigns, Gopher Strike and Sheet Attack, in September 2025 targeting Indian government entities. The activity was assessed with medium confidence as Pakistan-linked and showed some similarities to APT36 while possibly representing a new subgroup or parallel actor.
Open-source reporting describes sustained Pakistan-linked cyber-espionage activity during 2024 into 2025 against Indian government, defense, and academic organizations. The operations used spear-phishing, LNK and ISO payloads, Golang malware, cloud-based command-and-control, and in some cases Android spyware such as CapraRAT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcerescana.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice for Senior Field Officer roles. The infection chain delivers a ZIP archive containing a malicious `.lnk` file, a PowerShell script, and a `.NET` executable that installs the legitimate ControlR remote management agent alongside a custom RAT called **SheetAgent**. The malware persists through a scheduled task or Startup-folder shortcut, disguises files with Windows-like names, and uses anti-VM, anti-sandbox, and self-cleanup checks to hinder analysis. Seqrite said SheetAgent uses hardcoded Google service account credentials to access **Google Sheets** and **Google Drive**, with an attacker-controlled sheet acting as a backup command-and-control and exfiltration channel. Investigators also linked infrastructure at `38.242.157.89` to the decoy PDF and several authenticated management panels, including **SecureMonitor** and **PrivateRat**. The tradecraft overlaps with earlier campaigns that used cloud services such as Google Sheets, Firebase, GitHub, and Microsoft Graph for covert C2 against Indian targets, and Seqrite attributed the operation to **APT36** with medium confidence.
Jul 14, 2026
The Harvester APT group has deployed a new Linux variant of its **GoGra** backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in **India** and **Afghanistan**, with decoy documents referencing regional subjects such as **Zomato** and **Umrah**. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor. Once installed, the Linux malware uses **Microsoft Graph API** and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through `/bin/bash`, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Jun 29, 2026
The likely nation-state-backed **Harvester** group has expanded its espionage operations in South Asia with a new Linux variant of its `GoGra` backdoor, extending a toolset previously associated with Windows intrusions. Researchers linked the malware to Harvester through near-identical code, shared command-and-control logic, and matching spelling errors, and said the backdoor uses the **Microsoft Graph API** and Outlook mailboxes as a covert C2 channel to blend malicious traffic with legitimate cloud activity. Initial submissions tied to the malware came from **India** and **Afghanistan**, and the use of localized decoy documents indicates a tailored campaign against regional targets. Harvester has been active since at least 2021 and was previously observed targeting **telecommunications, government, and IT organizations**, particularly in Afghanistan, with custom malware including **Backdoor.Graphon**, a downloader, and a screenshot utility, alongside **Cobalt Strike Beacon** and **Metasploit**. In both earlier and newer activity, the group abused legitimate Microsoft infrastructure to evade perimeter defenses; the Linux `GoGra` sample persists through a `systemd` user service and an XDG autostart entry, then executes commands delivered through encrypted email messages. The campaign shows Harvester building a cross-platform espionage capability while maintaining a consistent focus on South Asian victims.
Jun 29, 2026