CampaignPublished 21 Aug 2025Updated 20 Sep 2025

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Source AlienVault OTX General

Description

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

Impact

For European organizations, the direct impact of this campaign is currently limited given its targeting focus on Indian government and defense entities and Linux systems. However, the tactics used—phishing with malicious Linux desktop shortcuts and leveraging legitimate cloud services for payload delivery—pose a broader risk to any European entities using Linux infrastructure, especially in sensitive sectors such as government, defense, research, and critical infrastructure. If adapted or redirected, similar campaigns could compromise confidentiality by exfiltrating sensitive data, integrity by implanting persistent malware, and availability by disrupting critical services. The use of Google Drive for payload hosting complicates detection and blocking efforts, potentially increasing the risk of successful infiltration. European organizations with Linux-based systems and remote access capabilities should be vigilant, as the campaign demonstrates advanced persistence and stealth techniques that could evade traditional endpoint security solutions. Additionally, the presence of a command and control IP in the Netherlands suggests potential abuse of European infrastructure for malicious purposes, which could have reputational and operational impacts on hosting providers and network operators in the region.

Defensive guidance

European organizations should implement targeted mitigations beyond generic advice: 1) Enforce strict email filtering rules to detect and quarantine phishing emails containing ZIP files, especially those with Linux ".desktop" files. 2) Deploy endpoint detection and response (EDR) solutions capable of analyzing Linux desktop shortcut files and monitoring for unusual system calls or persistence mechanisms. 3) Monitor network traffic for anomalous connections to suspicious domains such as "seemysitelive.store" and unusual WebSocket communications, particularly those involving cloud storage services like Google Drive. 4) Implement application whitelisting on Linux systems to prevent execution of unauthorized scripts or shortcuts. 5) Conduct user awareness training focused on recognizing phishing attempts that target Linux users, emphasizing the risks of opening unexpected ZIP attachments. 6) Collaborate with cloud service providers to monitor and block abuse of legitimate platforms for malware hosting. 7) Regularly audit and harden Linux system configurations to reduce attack surface, including disabling unnecessary services and restricting permissions on desktop entry files. 8) Establish threat intelligence sharing with European CERTs and industry groups to stay updated on emerging APT36 tactics and indicators.

Indicators of compromise

Domains 1

seemysitelive.store

URLs 1

http://seemysitelive.store:8080/ws

IP addresses 1

CC=NL ASN=AS210654 des capital b.v.

164.215.103.55

Hashes 10

566ddd4eb4ca8d4dd67b72ee7f944055
6ac0fe0fa5d9af8193610d710a7da63c
a484f85d132609a4a6b5ed65ece7d331
1982f09bfab3a6688bb80249a079db1a759214b7
3e3169c513c02126028480421fb341a167cb9fcd
508a3568c56ed4f613cfafef23ff12c81ba627eb
df4db969a69efc1db59f4d3c596ed590ee059777
34ad45374d5f5059cad65e7057ec0f3e468f00234be7c34de033093efc4dd83d
6347f46d77a47b90789a1209b8f573b2529a6084f858a27d977bf23ee8a79113
7a946339439eb678316a124b8d700b21de919c81ee5bef33e8cb848b7183927b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Aug 2025, 21:32 UTC

MITRE ATT&CK techniques16 from threat tags

Technical details