Transparent Tribe Target Indian Government's Custom Linux OS with Weaponized Desktop Files
Transparent Tribe, a cyber-espionage group believed to originate from Pakistan and also known as APT36, has stepped up its attacks on Indian government entities by using malicious desktop shortcuts designed to compromise both Windows and BOSS Linux systems.
The latest tactics involve spear-phishing emails featuring fake meeting notices. These emails contain desktop shortcut files disguised as PDF documents (e.g., “Meeting_Ltr_ID1543ops.pdf.desktop”). When recipients attempt to open what appears to be a typical PDF, they instead activate a shell script that initiates the attack chain.
The malicious script fetches a hex-encoded file from an attacker-controlled domain (“securestore[.]cv”), decodes it to an ELF binary, and saves it to the target computer's disk. During this process, the victim is shown a decoy PDF hosted on Google Drive, launched in Firefox, to avoid suspicion.
The dropped Go-based ELF binary then connects to a command-and-control (C2) server (“modgovindia[.]space:4000”), allowing attackers to issue commands, deliver additional malicious payloads, and steal sensitive data.
Transparent Tribe’s campaign ensures persistence by setting up a cron job that automatically runs the main payload after reboots or process terminations. The malware is equipped with reconnaissance capabilities and includes dummy anti-debugging and anti-sandbox techniques to dodge detection by analysts and automated analysis platforms.
A known backdoor associated with the group, Poseidon, is deployed for deeper intrusion. Poseidon enables long-term access, data exfiltration, credential theft, and lateral movement within compromised environments.
CloudSEK and Hunt.io, two cybersecurity firms, reported that this sophisticated campaign reflects APT36’s ongoing adaptation—modifying attacks based on the victim's operating system to maximize the success rate and persistence.
In recent weeks, similar attacks by Transparent Tribe targeted Indian defense organizations using spoofed login pages intended to collect credentials and two-factor authentication (2FA) codes, especially the Kavach 2FA system widely adopted within Indian government agencies.
The phishing pages, designed to closely resemble official Indian government sites, prompt users to enter both their email credentials and Kavach code. Typo-squatted domains and Pakistan-based infrastructure are consistently used, aligning with the group’s established tactics.
Recent campaigns have also targeted countries such as Bangladesh, Nepal, Pakistan, Sri Lanka, and Turkey using spear-phishing emails that mimic governmental communication and leverage lookalike pages for credential theft. Another South Asian group, SideWinder, has employed similar techniques, using fake Zimbra and portal pages to gather government users’ login information, illustrating the widespread threat landscape in the region.
