CampaignPublished 6 May 2025Updated 5 Jun 2025

APT36-Style ClickFix Attack Spoofs Indian Ministry to Target Windows & Linux

Source AlienVault OTX General

Description

A recent campaign attributed to APT36 has been observed spoofing India's Ministry of Defence to deliver cross-platform malware. The attackers used a ClickFix-style infection chain, mimicking government press releases and leveraging a compromised .in domain for payload staging. The campaign targeted both Windows and Linux users, employing clipboard-based execution techniques. On Windows, the attack utilized mshta.exe to execute a heavily obfuscated HTA file, while on Linux, it attempted to execute a shell script. The tradecraft observed, including government-themed lures, HTA-based delivery, and decoy documents, aligns with known APT36 tactics. This activity demonstrates the continued evolution of ClickFix techniques in new contexts.

Impact

For European organizations, the direct targeting of Indian government entities might suggest a lower immediate risk; however, the cross-platform nature of this campaign and the use of compromised domains could enable spillover infections or secondary targeting. European organizations with business ties to India, or those using similar Windows and Linux environments, could be at risk from phishing campaigns mimicking government or defense-related communications. The clipboard-based execution and use of mshta.exe pose risks of stealthy malware execution that can bypass some endpoint protections. If successful, the malware could compromise confidentiality by exfiltrating sensitive data, impact integrity by modifying or injecting malicious code, and affect availability by deploying additional payloads or backdoors. The use of obfuscated scripts and multi-stage infection chains complicates detection and response efforts. Additionally, the campaign’s use of compromised domains and masquerading techniques could facilitate lateral movement or persistence within networks. European defense contractors, government agencies, and organizations involved in Indo-European collaborations or supply chains may face increased risk due to the strategic importance of defense-related information. The campaign’s medium severity rating reflects the moderate complexity and targeted nature of the attack, but the evolving tactics and cross-platform capabilities warrant vigilance.

Defensive guidance

1. Implement strict email filtering and phishing detection mechanisms that specifically look for spoofed government domains and unusual domain patterns, including subdomains of compromised .in domains. 2. Deploy endpoint detection and response (EDR) solutions capable of monitoring and blocking mshta.exe executions, especially those invoking obfuscated HTA files. 3. Enforce application whitelisting policies to restrict execution of unauthorized scripts and HTA files on both Windows and Linux systems. 4. Monitor clipboard activity for suspicious command injections or unusual clipboard content changes, using advanced behavioral analytics where possible. 5. Conduct targeted user awareness training focusing on recognizing government-themed phishing lures and social engineering tactics, emphasizing the risks of executing attachments or links from unexpected sources. 6. Regularly audit and restrict the use of scripting interpreters like PowerShell, mshta.exe, and shell scripts, applying the principle of least privilege. 7. Monitor network traffic for connections to known malicious domains (e.g., avtzyu.store, drdosurvey.info) and block or investigate such communications. 8. Maintain up-to-date threat intelligence feeds to detect emerging APT36 indicators and update detection signatures accordingly. 9. Implement multi-factor authentication (MFA) and robust access controls to limit lateral movement if initial compromise occurs. 10. Conduct regular incident response drills simulating similar attack vectors to improve detection and containment capabilities.

Indicators of compromise

Domains 5

avtzyu.store
drdosurvey.info
trade4wealth.in
email.gov.in.avtzyu.store
email.gov.in.drdosurvey.info

Hashes 1

7087e5f768acaad83550e6b1b9696477089d2797e8f6e3f9a9d69c77177d030e

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jul 2025, 17:10 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details

Indicators of compromise

Domains 5

Hashes 1

Community reviews

Related threats