Tag: ctfuft

1 Attack Reports | 0 Vulnerabilities

Attack reports

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.
persistence
stealth
apt36
websocket
google drive
2025-08-21
syscall
icon data
ctfuft
linux desktop
stealth server
unix timestamp
Published: August 21, 2025
Downloadable IOCs: 6
Click here to see more Attack Reports