Loading story…
Researchers reported a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice for Senior Field Officer roles. The infection chain delivers a ZIP archive containing a malicious .lnk file, a PowerShell script, and a .NET executable that installs the legitimate ControlR remote management agent alongside a custom RAT called SheetAgent. The malware persists through a scheduled task or Startup-folder shortcut, disguises files with Windows-like names, and uses anti-VM, anti-sandbox, and self-cleanup checks to hinder analysis.
Seqrite said SheetAgent uses hardcoded Google service account credentials to access Google Sheets and Google Drive, with an attacker-controlled sheet acting as a backup command-and-control and exfiltration channel. Investigators also linked infrastructure at 38.242.157.89 to the decoy PDF and several authenticated management panels, including SecureMonitor and PrivateRat. The tradecraft overlaps with earlier campaigns that used cloud services such as Google Sheets, Firebase, GitHub, and Microsoft Graph for covert C2 against Indian targets, and Seqrite attributed the operation to APT36 with medium confidence.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Seqrite documented a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice, using a ZIP-delivered LNK, PowerShell, and .NET payload chain to install ControlR and the custom SheetAgent RAT. The report also identified infrastructure at 38.242.157.89 and attributed the activity to APT36 with medium confidence based on targeting and tradecraft similarities.
ThreatLabz described an active campaign targeting Windows systems in India that used PDF lures and later malicious LNK files to deliver the SHEETCREEP and FIREPOWER backdoors. The report also documented use of Google Sheets, Firebase, GitHub, and Microsoft Graph/Azure-based cloud services for command-and-control and exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceseqrite.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active cyber espionage campaign linked with moderate confidence to **APT36** (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to **Afghan Telecom**, government updates, and software installers. The operation uses a malware cluster that includes **HACKERAI C2 Agent**, **PATCHCORD**, and **SHEETCORD**, showing an evolution from earlier custom C/C++ tooling to newer **Go-based implants**. The malware uses legitimate cloud services as covert command-and-control channels, with **HACKERAI** abusing **GitHub Gists** and **SHEETCORD** using **Google Sheets** for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple `SHA-256` hashes.
Aug 26, 2026
Security researchers reported **Pakistan-linked threat activity** targeting Indian government entities in campaigns dubbed **Gopher Strike** and **Sheet Attack**, assessed with *medium confidence* to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to **APT36**. **Sheet Attack** uses legitimate services including **Google Sheets**, **Firebase**, and email for command-and-control (C2), while **Gopher Strike** begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an *Adobe Acrobat Reader DC* update. In **Gopher Strike**, clicking the “Download and Install” lure triggers delivery of an **ISO** payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, **GOGITTER**, which creates a VBScript (e.g., `windows_api.vbs`) in common directories (including `C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, and `%APPDATA%`) to poll for instructions and retrieve additional payloads, including **GITSHELLPAD**, which is described as leveraging **private GitHub repositories** (with embedded authentication tokens) for staging/persistence and follow-on access.
Jun 29, 2026
Google Threat Intelligence Group (**GTIG**), *Mandiant*, and industry partners reported disrupting infrastructure used by suspected China-nexus cyber-espionage actor **UNC2814**, assessed to have breached **at least 53 organizations across 42 countries**, with additional suspected infections in **20+** more countries. The activity primarily targeted **government** and **telecommunications** networks across Africa, Asia, and the Americas, and used **SaaS API calls** to blend command-and-control (C2) traffic into legitimate cloud application activity; the initial access vector remains under investigation, though the actor has a history of exploiting **web servers and edge systems**. The disrupted campaign featured a new C-based backdoor, **GRIDTIDE**, which abuses the **Google Sheets API** as an evasive C2 channel to exchange commands and data. Reported capabilities include arbitrary shell command execution and file upload/download; the malware authenticates using a Google service account (including a hardcoded private key), uses spreadsheet cells (e.g., `A1` for command/status and `A2:An` for output/exfiltration), and implements polling logic that shifts to less frequent randomized checks to reduce noise. Post-compromise tradecraft included lateral movement via **SSH** using a service account, **living-off-the-land** activity for recon/privilege escalation/persistence, persistence via a systemd service at `/etc/systemd/system/xapt.service` launching `/usr/sbin/xapt`, and use of **SoftEther VPN Bridge** to establish encrypted outbound connectivity.
Jun 29, 2026