Threats Tagged 'deskrat'

TransparentTribe, a Pakistani-linked threat actor, is conducting a cyber espionage campaign targeting Indian military organizations using DeskRAT, a Golang-based Remote Access Trojan. The attack begins with phishing emails containing links to malicious ZIP archives that deploy multi-stage payloads designed for Linux environments, specifically targeting the Indian government-endorsed BOSS operating system. DeskRAT establishes command and control over WebSocket connections and uses various persistence techniques to maintain access. The campaign leverages regional tensions and local protests to increase the likelihood of successful compromise. While primarily focused on Indian military targets, the malware's Linux focus and sophisticated evasion techniques highlight a targeted espionage effort. No known exploits or CVEs are associated with this malware yet, and the severity is assessed as medium. European organizations are not the primary target but could be indirectly impacted if geopolitical tensions escalate or if similar tactics are adopted against allied or related entities. Defenders should focus on phishing prevention, monitoring WebSocket traffic, and hardening Linux systems, especially those running government or military-grade OS variants.

MediumMalwareFranceGermanyItaly+5#deskrat#government#t1113