APT36, also known as Transparent Tribe, has launched a new cyber-espionage campaign targeting the Indian government and strategic sectors.
The Pakistan-based threat actor has long been known for its persistent activity against Indian entities, but this latest operation demonstrates a significant technical evolution.
According to CYFIRMA’s analysis, the group has developed and deployed customized malware explicitly designed for Linux-based environments, including India’s BOSS operating system, which is commonly used across government networks.
The campaign begins with spear-phishing emails carrying malicious Linux shortcut files disguised as harmless documents. These files are delivered in an archive named Analysis_Proc_Report_Gem_2025.zip and appear legitimate to the recipient.
When opened, the .desktop file silently executes embedded commands while displaying a decoy PDF to distract the user. In the background, it downloads additional payloads from an attacker-controlled server, including an ELF binary named swcbc and a shell script named swcbc.sh.
These payloads are stored in the system’s temporary directory, granted execution permissions, and then launched to establish persistence and command control communication with remote infrastructure.
The ELF binary, created with PyInstaller, is a Python-based Remote Administration Tool that runs on both Linux and Windows.
It collects system details, generates a unique device identifier using the username and MAC address, and communicates with its command-and-control server using HTTP POST requests.
Once operational, the malware executes remote shell commands, transfers files in both directions, captures screenshots, compresses data for exfiltration, and maintains persistence through Linux systemd services.
This design allows the malware to run automatically after reboot and blend with legitimate processes.
Technical Details and Operational Infrastructure
The malicious infrastructure used in this campaign includes the domain lionsdenim[.]xyz and the IP address 185.235.137.90, both of which are tied to APT36 activities.
The domain was recently registered through Namecheap and is hosted on a shared server in the United States, consistent with the short-term nature of APT-controlled assets.
The IP address in Germany serves as a payload-delivery host, responsible for distributing the ELF binary and related scripts.
APT36’s operations show a deliberate focus on multi-platform espionage and adaptive malware design.
By using .desktop files instead of distributing ELF executables directly, the attackers reduce detection risk and bypass traditional Linux security mechanisms.
Security experts recommend blocking access to identified domains and IPs, updating BOSS Linux systems, and monitoring network traffic for signs of communication with unknown infrastructure.
Organizations should also restrict execution permissions in temporary directories, turn off the auto-run of shortcut files, and increase awareness of phishing tactics.
The campaign highlights APT36’s growing sophistication, as the group rapidly adapts its infiltration methods to India’s evolving technology landscape.
Focused on persistent access and intelligence collection, this operation reflects a broader shift toward targeting indigenous Linux ecosystems and expanding the group’s long-term espionage capabilities.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
