MalwarePublished 22 Aug 2025

type osint · Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Impact

For European organizations, the APT36 campaign poses a significant risk to confidentiality, integrity, and availability of critical systems. The use of phishing and social engineering increases the likelihood of initial compromise, especially in sectors with less mature cybersecurity awareness. Once inside, the malware’s persistence mechanisms and network reconnaissance capabilities enable lateral movement and data exfiltration, potentially leading to intellectual property theft, espionage, or disruption of services. Critical infrastructure, government agencies, and organizations handling sensitive data are at heightened risk due to the strategic interest of the threat actor. The campaign’s use of cloud services like Google Drive for payload delivery complicates detection and response, as these services are commonly trusted and widely used. The medium severity rating reflects the campaign’s targeted nature and requirement for user interaction, but the potential for significant operational and reputational damage remains high. European entities with extensive use of Windows environments and reliance on cloud collaboration tools are particularly vulnerable.

Defensive guidance

1. Implement advanced email filtering and phishing detection solutions that specifically scan for malicious desktop entry files and suspicious links, including those hosted on cloud platforms like Google Drive. 2. Conduct regular user awareness training focused on recognizing phishing attempts and the risks of opening unknown files or links, emphasizing the threat of desktop entry files as malware vectors. 3. Monitor endpoint systems for creation or modification of Windows services and hidden files/directories, using behavioral analytics to detect masquerading and persistence techniques. 4. Restrict or monitor the use of cloud storage services for inbound payload delivery, employing data loss prevention (DLP) and cloud access security broker (CASB) solutions to control and inspect file transfers. 5. Enforce strong authentication and account lockout policies to mitigate brute force attacks, and implement network segmentation to limit lateral movement. 6. Deploy network monitoring tools capable of detecting anomalous traffic on non-standard ports and unusual protocol usage, correlating with known indicators of ingress tool transfer and command and control communications. 7. Maintain up-to-date threat intelligence feeds and integrate them into security operations to identify emerging TTPs related to Operation C-Major and APT36. 8. Conduct regular security assessments and penetration testing to identify and remediate gaps in phishing resilience and endpoint security controls.

Indicators of compromise

Domains 1

seemysitelive.store

URLs 1

ws://seemysitelive.store:8080/ws

IP addresses 2

164.215.103.55
45.155.54.28seemysitelive.store: Enriched via the dns module

Hashes 9

6ac0fe0fa5d9af8193610d710a7da63c
3e3169c513c02126028480421fb341a167cb9fcd
34ad45374d5f5059cad65e7057ec0f3e468f00234be7c34de033093efc4dd83d
a484f85d132609a4a6b5ed65ece7d331
1982f09bfab3a6688bb80249a079db1a759214b7
6347f46d77a47b90789a1209b8f573b2529a6084f858a27d977bf23ee8a79113
566ddd4eb4ca8d4dd67b72ee7f944055
df4db969a69efc1db59f4d3c596ed590ee059777
7a946339439eb678316a124b8d700b21de919c81ee5bef33e8cb848b7183927b

File 2

PROCUREMENT_OF_MANPORTABLE_&_COMPAC.pdf.zip
PROCUREMENT_OF_MANPORTABLE_\&_COMPAC.pdf.desktop

Community reviews

Loading reviews…