Breaches and incidents
Sindoor Dropper (India): Operation Sindoor-themed .desktop lure installs MeshAgent on Linux
Nextron Systems analysed “Note_Warfare_Ops_Sindoor.pdf.desktop”, which opens a decoy PDF while staged components (an AES decryptor, a downloader) install a...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Nextron Systems analysed “Note_Warfare_Ops_Sindoor.pdf.desktop”, which opens a decoy PDF while staged components (an AES decryptor, a downloader) install a repurposed MeshAgent remote-administration agent connecting to wss://boss-servers.gov.in.indianbosssystems.ddns[.]net:443/agent.ashx on AWS EC2 (Cyber Security News).
- Root cause: user execution of a Linux .desktop file.
- Attacker: not attributed; the .desktop technique and BOSS-themed C2 match earlier APT36 activity.
- Response: IOCs published.