Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT36, a Pakistan-linked threat group, has expanded its operations to target Indian government and civilian infrastructure, including railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing techniques and novel payload strategies, using .desktop files disguised as PDF documents to execute malicious scripts. Two attack variants were identified, utilizing single and redundant command and control server setups. The Poseidon backdoor, built on the Mythic framework, is deployed for persistent access and lateral movement. Over 100 phishing domains impersonating Indian government organizations were discovered, primarily hosted by AlexHost. The campaign, active since early July 2025, poses a significant threat to Indian public sector and critical infrastructure.

The threat involves APT36, a Pakistan-linked advanced persistent threat group, targeting Indian government and civilian infrastructure sectors such as railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing campaigns using deceptive .desktop files disguised as PDF documents to execute malicious scripts on victim machines. These files exploit user trust and social engineering to bypass security controls and initiate payload execution. Two variants of the attack have been identified, differing in their command and control (C2) server architecture—one using a single C2 server and another employing redundant C2 servers to enhance resilience and persistence. The primary malware deployed is the Poseidon backdoor, which is built on the Mythic framework, a modular and flexible post-exploitation toolset. Poseidon enables persistent access, lateral movement within networks, credential theft, and data exfiltration. The campaign also involves over 100 phishing domains impersonating Indian government organizations, primarily hosted by AlexHost, to increase the credibility of phishing lures and facilitate credential harvesting or malware delivery. The campaign has been active since early July 2025 and represents a significant threat to Indian public sector entities and critical infrastructure. The attack techniques align with multiple MITRE ATT&CK tactics and techniques including phishing (T1566), execution via user execution (T1204), persistence (T1547), lateral movement (T1071), and defense evasion (T1070, T1027). The use of .desktop files as lures is novel and leverages Linux desktop environments, indicating targeting of systems running Linux or Unix-like OSes, which are common in infrastructure environments. The absence of known exploits in the wild suggests the threat relies heavily on social engineering and custom malware deployment rather than exploiting publicly known vulnerabilities.

Detailed information about Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor. Get real-time updates, technical details, and mitigation str

Title	Severity	Type	Source	Date

Threats Tagged 'government impersonation'

Filter Threats

Threats Tagged 'government impersonation'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility