Transparent Tribe (APT36) Targets Indian Defense Sector with DeskRAT

Summary

The Pakistan-linked threat actor Transparent Tribe (APT36), also known as Mythic Leopard, ProjectM, TEMP.Lapis, Earth Karkaddan, Copper Fieldstone, and Storm-0156, has launched a targeted cyber-espionage campaign against Indian military, defense, and government organizations. The campaign focuses on systems running BOSS Linux, India’s official government distribution, deploying a custom Golang-based Remote Access Trojan (RAT) named DeskRAT.

This advanced attack chain begins with spear-phishing emails disguised as defense-related communications referencing civil unrest and regional incidents. These lures deliver malicious ZIP archives that contain .desktop dropper files and decoy PDFs. Once executed, DeskRAT provides stealthy remote access, enabling file exfiltration, persistence, and long-term surveillance on compromised systems.

The campaign represents APT36’s strategic evolution—transitioning from Windows-based malware to Linux-focused espionage operations, aligning with the group’s continued targeting of Indian defense assets to support Pakistan’s intelligence objectives.

Attack Details

Infection Vector and Delivery

Transparent Tribe leverages spear-phishing emails that mimic legitimate Indian defense communications. These emails reference real-world events like Ladakh unrest or military directives, enhancing credibility.

• The phishing emails deliver ZIP files hosted on dedicated staging domains such as modgovindia[.]space, containing:
  • A malicious .desktop dropper file.
  • A decoy PDF that opens in Firefox to distract the victim.

Execution and Payload

When the .desktop file is executed, it triggers a Bash one-liner that downloads, decodes, and launches the DeskRAT payload. The malware uses built-in Linux utilities to evade detection and initiate covert operations.

DeskRAT establishes a WebSocket-based Command and Control (C2) channel using fake metadata to blend in with legitimate network traffic. Once connected, it allows attackers to:

• Browse local directories.
• Exfiltrate files (up to 100MB).
• Deploy secondary payloads.
• Execute remote commands.

Persistence and Stealth

DeskRAT employs four persistence mechanisms tailored for Linux environments:

1. systemd units
2. cron jobs
3. autostart desktop entries
4. bash startup scripts (in .bashrc)

Its source code reveals LLM-assisted development patterns and placeholder functions to hinder reverse engineering.

Strategic Intent

The campaign’s timing and focus align with Pakistan’s regional intelligence goals, signaling an escalation in Linux-based espionage targeting India’s defense digital infrastructure.

Recommendations

Harden Linux System Defenses

• Update all BOSS Linux systems with the latest security patches.
• Remove unnecessary utilities (like xxd) and restrict execution permissions in user and temporary directories.
• Enforce least-privilege policies to reduce potential exploitation vectors.

Monitor and Block Spear-Phishing Campaigns

• Deploy advanced email security filters with sandboxing and URL reputation analysis.
• Block attachments with .desktop files or ZIP archives containing executable content.
• Conduct awareness training for personnel handling defense communications.

Detect Malicious Artifacts

• Continuously monitor for:
  • Unauthorized .desktop files.
  • Modified .bashrc entries.
  • Abnormal systemd or cron jobs.
• Use file integrity monitoring (FIM) and Endpoint Detection and Response (EDR) to detect DeskRAT persistence.

Inspect Network Traffic

• Monitor for unexpected ws:// connections or WebSocket activity on port 8080.
• Block traffic to known Transparent Tribe infrastructure and maintain updated threat intelligence feeds.

Indicators of Compromise (IoCs)

SHA256 Hashes:

• 43715401531e0060827d3dcfd406add434829192051fe76d5ffdbb22602cc136
• 567dfbe825e155691329d74d015db339e1e6db73b704b3246b3f015ffd9f0b33

MD5 Hashes:

• 4c56fedd177108a8849cec423f020625
• 3563518ef8389c7c7ac2a80984a2c4cd

File Names:

• MoM_regarding_Defence_Sectors_by_Secy_Defence_25_Sep_2025.zip
• MoM_regarding_Defence_Sectors_by_Secy_Defence_25_Sep_2025.desktop

File Paths:

• /tmp/MoM_regarding_Defence_Sectors_by_Secy_Defence_25-Sep_2025-<timestamp>
• $HOME/.config/autostart/system-backup.desktop
• $HOME/.config/system-backup/startup.sh
• $HOME/.config/system-backup/client.log

Domain:

• modgovindia[.]com

URLs:

• hxxps[:]//modgovindia[.]com/download[.]php?file=Gimpfile[.]txt
• hxxps[:]//modgovindia[.]com/CDS_Directive_Armed_Forces[.]pdf

IPv4 Address:

• 147[.]93[.]155[.]118

MITRE ATT&CK TTPs

TacticTechniqueTechnique IDInitial AccessSpearphishing AttachmentT1566.001ExecutionUnix Shell Command and Scripting InterpreterT1059.004PersistenceBoot or Logon Autostart Execution, systemdT1543.003, T1547Defense EvasionObfuscated Files or InformationT1027DiscoverySystem Information DiscoveryT1082CollectionData from Local SystemT1005ExfiltrationExfiltration Over C2 ChannelT1041Command and ControlWebSocket-based C2T1071ImpactData Theft and EspionageT1499DeobfuscationDecode Files or InformationT1140Hide ArtifactsHidden Files and DirectoriesT1564.001

References

• Sekoia.io – Transparent Tribe Targets Indian Military Organisations with DeskRAT
• Hive Pro – APT36’s Covert Linux Attack on India’s Defense Sector