TransparentTribe Targets Indian Military with DeskRAT Malware

TransparentTribe, a Pakistani-linked threat actor, is conducting a cyber espionage campaign targeting Indian military organizations using DeskRAT, a Golang-based Remote Access Trojan. The attack begins with phishing emails containing links to malicious ZIP archives that deploy multi-stage payloads designed for Linux environments, specifically targeting the Indian government-endorsed BOSS operating system. DeskRAT establishes command and control over WebSocket connections and uses various persistence techniques to maintain access. The campaign leverages regional tensions and local protests to increase the likelihood of successful compromise. While primarily focused on Indian military targets, the malware's Linux focus and sophisticated evasion techniques highlight a targeted espionage effort. No known exploits or CVEs are associated with this malware yet, and the severity is assessed as medium. European organizations are not the primary target but could be indirectly impacted if geopolitical tensions escalate or if similar tactics are adopted against allied or related entities. Defenders should focus on phishing prevention, monitoring WebSocket traffic, and hardening Linux systems, especially those running government or military-grade OS variants.

• Targeted Attack on Government Entities in the Middle East | Part 1Malware2026-07-21
• Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting UkraineMalware2026-03-18
• Operation CamelClone: Multi-Region Espionage Campaign Targets Government and Defense Entities Amidst Regional TensionsMalware2026-03-16
• Silver Dragon Targets Organizations in Southeast Asia and EuropeMalware2026-03-03
• Dust Specter APT Targets Government Officials in IraqMalware2026-03-02