MalwarePublished 2 Sep 2025

Sindoor Dropper: New Phishing Campaign

Source AlienVault OTX General

Description

A sophisticated phishing campaign targeting Indian organizations has been uncovered, utilizing spear-phishing techniques reminiscent of Operation Sindoor. The campaign employs a Linux-focused infection method using weaponized .desktop files, a tactic previously associated with APT36. When executed, these files initiate a complex, obfuscated chain that ultimately delivers a MeshAgent payload, granting the attacker full remote access to the compromised system. The campaign showcases an evolution in regional threat actor tactics, particularly in targeting Linux environments. By combining localized spear-phishing lures with advanced obfuscation techniques, the adversaries increase their chances of bypassing defenses and gaining footholds in sensitive networks. The attack chain involves multiple stages of encryption and decryption, anti-VM checks, and the use of legitimate remote administration tools to complicate detection and response efforts.

Impact

For European organizations, the direct impact of the Sindoor Dropper campaign may currently be limited due to its primary targeting of Indian organizations and use of localized spear-phishing lures. However, the campaign demonstrates a significant evolution in Linux-targeted attacks by APT36, indicating that similar tactics could be adapted for broader geographic targeting, including Europe. European organizations with Linux infrastructure, especially those in sectors with strategic or diplomatic ties to India or South Asia, could be at risk if the campaign expands or variants emerge. The use of weaponized .desktop files and MeshAgent payloads could lead to full system compromise, resulting in unauthorized remote access, data theft, espionage, and potential disruption of critical services. The advanced obfuscation and anti-VM techniques increase the difficulty of detection, potentially allowing attackers to maintain persistence and conduct prolonged operations. This threat underscores the need for vigilance in Linux environments, which are often perceived as less targeted and thus may have weaker defenses against such sophisticated attacks.

Defensive guidance

To mitigate the risk posed by the Sindoor Dropper campaign, European organizations should implement several specific measures beyond generic advice: 1) Enforce strict email filtering and spear-phishing detection capabilities that include contextual and linguistic analysis to identify localized phishing attempts, even if not directly targeting Europe. 2) Restrict execution of .desktop files and other executable scripts received via email or downloaded from untrusted sources, using application whitelisting and execution control policies tailored for Linux environments. 3) Deploy advanced endpoint detection and response (EDR) solutions capable of identifying obfuscated payloads, anti-VM evasion techniques, and unusual use of legitimate remote administration tools like MeshAgent. 4) Monitor network traffic for connections to suspicious or known malicious domains and IPs, such as those identified in the campaign (e.g., boss-servers.gov.in.indianbosssystems.ddns.net), and block or alert on such communications. 5) Conduct regular threat hunting exercises focused on Linux systems to detect signs of persistence, process injection, and lateral movement techniques associated with this campaign. 6) Educate users, particularly those in sensitive roles or with access to Linux systems, about spear-phishing risks and the dangers of executing unknown files, emphasizing the unique threat posed by weaponized .desktop files. 7) Maintain up-to-date backups and incident response plans that include scenarios involving Linux-targeted remote access trojans and advanced persistent threats. 8) Collaborate with threat intelligence providers to receive timely updates on emerging variants and indicators of compromise related to APT36 and similar actors.

Indicators of compromise

Domains 2

boss-servers.gov.in.indianbosssystems.ddns.net
indianbosssystems.ddns.net

URLs 1

http://boss-servers.gov.in.indianbosssystems.ddns.net:443/agent.ashx

Hashes 17

8a7ac7c3511a452198e08eb68c5f8948
38aa8d51695fe3c137ccaf17ca3fe4fb407b3b22
05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8
0f4ef1da435d5d64ccc21b4c2a6967b240c2928b297086878b3dcb3e9c87aa23
231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1
38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4
6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443
6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1
9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59
9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Sep 2025, 09:32 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 2

URLs 1

Hashes 17

Community reviews

Related threats