India’s cyber defense landscape faced a significant escalation in threats as state-sponsored group APT36, in coordination with Sidecopy and multiple hacktivist alliances, launched a sweeping campaign targeting the country’s critical infrastructure.
The multifaceted offensive known as Operation Sindoor marked a convergence of cyber espionage, targeted malware attacks, hacktivist disruption, and elements of hybrid warfare, revealing the growing sophistication and deliberate alignment of nation-state and non-state actors in the South Asian cyber conflict theater.
Sophisticated Attack Vectors
The first indicators of compromise emerged on April 17, 2025, as government systems registered anomalous activity.
Attackers deployed spear-phishing campaigns leveraging malicious documents disguised with urgent, topical filenames.
These files utilizing extensions such as .xlam, .ppam, and .pptx.lnk carried macro-laden payloads and shortcuts engineered to execute covert web queries and initiate command-and-control (C2) communications via malicious domains including fogomyart[.]com.
These highly targeted decoys, themed after sensitive national incidents like the Pahalgam Terror Attack, aimed to maximize user engagement and exploit emotional triggers.
The technical arsenal of APT36 has evolved from traditional loaders such as Poseidon, now replaced by the more modular and evasive Ares RAT framework.
The new toolkit, distributed through spoofed Indian domains (e.g., zohidsindia[.]com, nationaldefensecollege[.]com), grants attackers robust capabilities: remote command execution, keystroke logging, credential theft, screen capture, and persistent system access all designed for stealth and evasiveness.
Operation Sindoor’s campaign extended well beyond espionage, layering hacktivist-driven operations atop targeted malware attacks.
From May 7–10, Seqrite Labs telemetry recorded over 650 cases of DDoS attacks and website defacement, with at least 35 hacktivist groups seven newly emerged actively contributing to the disruption.
Synchronization via Telegram channels under monikers like #OpIndia and #OperationSindoor enabled rapid mobilization and amplified impact, with digital offensives against sectors such as defense, government IT, healthcare (notably AIIMS), telecom, and education.
The operation’s infrastructure mirrored the scope of a military campaign, with a wide array of deceptive domains (pahalgamattack[.]com, operationsindoor2025[.]in, sindoor[.]website) designed to lure targets from across strategic Indian sectors.
These domains increased the plausibility of the phishing payloads, reducing the likelihood of user suspicion.
Operational Risks
The consequences of the Operation Sindoor campaign have rippled across India’s national cybersecurity posture:
- Data Exfiltration: Sensitive documents, credentials, and user data were exfiltrated, jeopardizing strategic and operational security.
- DDoS Disruptions: Critical government and citizen-facing services faced denial-of-service outages, impeding essential workflows and public accessibility.
- Website Defacement: Psychological and reputational impacts were amplified, undermining public confidence and signaling cyber dominance.
APT36’s adoption of living-off-the-land binaries (LOLBins), scheduled tasks, UAC bypasses, and obfuscated PowerShell scripts underscores a deliberate emphasis on persistence and stealth, allowing for long-term infiltration while remaining under the radar of conventional defenses.
Indian cybersecurity authorities, led by Seqrite Labs, responded by deploying 26 custom detection signatures across extended detection and response (XDR) platforms, enhancing YARA correlation, and issuing advisories to affected sectors.
Continuous threat hunting, dark web surveillance, and real-time alerting have become part of the national cyber defense strategy in response to the layered threats posed by APT36, Sidecopy, and their hacktivist partners.
As Operation Sindoor illustrates, the merging of state and hacktivist cyber capabilities represents a new frontier in digital warfare.
The tools may evolve, but the objectives disrupt, destabilize, and influence remain constant, urging an urgent reevaluation of critical infrastructure resilience and cross-sectoral cyber defense readiness.
Indicators of Compromise
| Category | Indicator | Description |
|---|---|---|
| Malicious Domains | pahalgamattack[.]com | Phishing/C2 domain |
| operationsindoor2025[.]in | Phishing/C2 domain | |
| sindoor[.]website | Phishing domain | |
| sindoor[.]live | Phishing domain | |
| fogomyart[.]com/random.php | Web query for macro payloads | |
| nationaldefensecollege[.]com | Spoofed payload delivery domain | |
| zohidsindia[.]com | Spoofed payload delivery domain | |
| Malicious Files | .xlam, .ppam, .pptx.lnk, .xlsb, .msi, .pdf | Malware-laden lure files |
| Callback IP | 167.86.97[.]58:17854 | Crimson RAT C2 server |
| VPS Origin Locations | Russia, Germany, Indonesia, Singapore | Observed traffic sources |
| Detection Signatures | BAT.Sidecopy.49534.GC, LNK.Sidecopy.49535.GC, etc. | Custom detection for malware variants |
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
