MalwarePublished 1 Aug 2025Updated 31 Aug 2025

Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor

Source AlienVault OTX General

Description

APT36, a Pakistan-linked threat group, has expanded its operations to target Indian government and civilian infrastructure, including railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing techniques and novel payload strategies, using .desktop files disguised as PDF documents to execute malicious scripts. Two attack variants were identified, utilizing single and redundant command and control server setups. The Poseidon backdoor, built on the Mythic framework, is deployed for persistent access and lateral movement. Over 100 phishing domains impersonating Indian government organizations were discovered, primarily hosted by AlexHost. The campaign, active since early July 2025, poses a significant threat to Indian public sector and critical infrastructure.

Impact

For European organizations, the direct impact of this specific campaign may be limited given the targeting focus on Indian infrastructure and government entities. However, the tactics and malware used by APT36, including the Poseidon backdoor and sophisticated phishing with desktop lures, represent a broader threat model that could be adapted against European critical infrastructure or government targets. The use of novel delivery mechanisms such as .desktop files disguised as PDFs could bypass traditional email security filters and endpoint protections if similar campaigns were launched in Europe. European organizations operating in sectors like energy, transportation, and government should be aware of the potential for similar threat actor tactics to be used against them. Additionally, the hosting provider AlexHost, used for phishing domains, may also host malicious infrastructure targeting European entities, warranting monitoring. The lateral movement and persistence capabilities of the Poseidon backdoor pose risks of prolonged undetected intrusions, data theft, and operational disruption if deployed successfully. The campaign underscores the need for vigilance against social engineering and the importance of securing Linux-based infrastructure components, which are prevalent in European critical sectors.

Defensive guidance

1. Implement advanced email filtering and sandboxing solutions that can detect and block phishing emails containing deceptive .desktop files or other unusual attachments. 2. Educate users, especially those in critical infrastructure sectors, on the risks of opening unexpected attachments, particularly files with uncommon extensions like .desktop, even if they appear to be PDFs. 3. Enforce strict application whitelisting and execution policies on Linux and Unix-like systems to prevent unauthorized script execution from user directories or email downloads. 4. Monitor network traffic for unusual outbound connections, especially to known or suspicious C2 servers, and implement DNS filtering to block access to phishing domains impersonating government organizations. 5. Deploy endpoint detection and response (EDR) solutions capable of identifying behaviors associated with the Mythic framework and Poseidon backdoor, such as lateral movement, credential dumping, and persistence mechanisms. 6. Regularly audit and harden Linux-based infrastructure, ensuring timely patching and removal of unnecessary services to reduce attack surface. 7. Collaborate with hosting providers like AlexHost to identify and take down phishing domains used in such campaigns. 8. Conduct threat hunting exercises focused on detecting indicators of compromise related to APT36 tactics and Poseidon backdoor activity. 9. Implement multi-factor authentication (MFA) across all critical systems to reduce the impact of credential theft. 10. Establish incident response plans tailored to address advanced persistent threats targeting infrastructure and government sectors.

Indicators of compromise

Domains 34

dayenter.shop
dmsupport.live
nominationdrdo.report
37-221-64-252.cprapid.com
accounts.mgovcloud.in.cloudshare.digital
accounts.mgovcloud.in.indiagov.support
accounts.mgovcloud.in.storagecloud.download
drdo.gov.in.nominationdrdo.report
email.gov.in.briefcases.email
email.gov.in.defencedept.work

IP addresses 6

165.22.251.224
178.128.204.138
165.232.114.63
209.38.203.53
37.221.64.202
64.227.189.57

Hashes 19

589cf2077569b95178408f364a1aa721
5c71c683ff55530c73477e0ff47a1899
6065407484f1e22e814dfa00bd1fae06
65167974b397493fce320005916a13e9
76e9ff3c325de4f2d52f9881422a88cb
8d46a7e4a800d15e31fb0aa86d4d7b7f
b3f57fe1a541c364a5989046ac2cb9c5
e354cf4cc4177e019ad236f8b241ba3c
0c903f9e744c122421cf84af8b7df06b079aa097
1814730cb451b930573c6a52f047301bff0b84d1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Aug 2025, 12:47 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 34

IP addresses 6

Hashes 19

Community reviews

Related threats