SecuriTricks

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

persistence

stealth

Published: August 21, 2025

Downloadable IOCs: 6

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge

In May 2025, Pakistan-linked hacktivist groups claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites. However, an investigation reveals most breaches were exaggerated or fake. Alleged data leaks contained primarily public information, website defacement…

Published: May 11, 2025

Downloadable IOCs: 0

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

A Pakistan-based APT group, assessed with medium confidence as APT36, who created a fake IndiaPost website to target and infect both Windows and Android users.

Published: March 27, 2025

Downloadable IOCs: 5

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor targeting Indian government and military entities. Their campaigns utilize ElizaRAT, a Windows Remote Access Tool that has evolved to enhance evasion techniques and C2 communication. Recent campaigns employ cloud services like…

Published: November 4, 2024

Downloadable IOCs: 23

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe

This investigation tracked infrastructure linked to the APT group Transparent Tribe, identifying 15 malicious hosts on DigitalOcean serving as command-and-control servers for the Mythic exploitation framework. The group employs Linux desktop entry files as an attack vector, targeting individuals in…

Published: September 30, 2024

Downloadable IOCs: 19

Tag: apt36

Attack reports

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Phishing Attack: Deploying Malware on Indian Defense BOSS Linux

Illuminating Transparent Tribe

Operation Sindoor: Anatomy of a High-Stakes Cyber Siege

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe