{"id":30974,"date":"2025-10-27T00:55:55","date_gmt":"2025-10-27T00:55:55","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/apt36-hits-india-with-golang-malware\/"},"modified":"2025-10-27T00:55:58","modified_gmt":"2025-10-27T00:55:58","slug":"apt36-hits-india-with-golang-malware","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/apt36-hits-india-with-golang-malware\/","title":{"rendered":"APT36 Hits India with Golang Malware"},"content":{"rendered":"[ad_1]\n<\/p>\n
\n

<\/i>Oct 24, 2025<\/span><\/i>Ravie Lakshmanan<\/span><\/span>Cyber Espionage \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

A threat actor with ties to Pakistan has been identified as targeting Indian government entities through spear-phishing attacks, with the ultimate goal of delivering a Golang-based malware known as DeskRAT<\/strong>.<\/p>\n

The activity, observed<\/a> in August and September 2025 by Sekoia, has been attributed to Transparent Tribe<\/a> (also known as APT36), a state-sponsored hacking group that has been active since at least 2013. This campaign builds upon a prior one disclosed<\/a> by CYFIRMA in August 2025.<\/p>\n

The attack chains involve sending phishing emails that contain a ZIP file attachment or a link to an archive hosted on legitimate cloud services like Google Drive. The ZIP file contains a malicious Desktop file that embeds commands to display a decoy PDF (“CDS_Directive_Armed_Forces.pdf”) using Mozilla Firefox, while simultaneously executing the main payload.<\/p>\n

Both the artifacts are pulled from an external server “modgovindia[.]com” and executed. The campaign is designed to target BOSS (Bharat Operating System Solutions) Linux systems, with the remote access trojan capable of establishing command-and-control (C2) using WebSockets.<\/p>\n

The malware supports four different methods for persistence, including creating a systemd service, setting up a cron job, adding the malware to the Linux autostart directory (“$HOME\/.config\/autostart”), and configuring.bashrc to launch the trojan by means of a shell script written to the “$HOME\/.config\/system-backup\/” directory.<\/p>\n

\"DFIR<\/a><\/center><\/div>\n

DeskRAT supports five different commands –<\/p>\n