Breaches and incidents
Transparent Tribe / APT36 (India): BOSS Linux .desktop lures deliver Go malware and DeskRAT to government users
CYFIRMA (22 Aug 2025) found spear-phishing ZIPs such as “Meeting_Notice_Ltr_ID1543ops.pdf_.zip” containing a .desktop file disguised as a PDF that curls a...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CYFIRMA (22 Aug 2025) found spear-phishing ZIPs such as “Meeting_Notice_Ltr_ID1543ops.pdf_.zip” containing a .desktop file disguised as a PDF that curls a hex-encoded payload, converts it with xxd, runs a Go ELF from /tmp, opens a Google Drive decoy in Firefox, and persists via a user systemd service and @reboot cron; C2 modgovindia[.]space:4000. Sekoia then documented DeskRAT (Aug to Sep 2025) using a “CDS_Directive_Armed_Forces.pdf” decoy pulled from modgovindia[.]com, with WebSocket C2 and four persistence methods; QiAnXin XLab linked Windows StealthServer variants (July to August 2025) (The Hacker News).
- Root cause: users executing .desktop launchers from archives on BOSS Linux.
- Attacker: Transparent Tribe (Pakistan-nexus) per CYFIRMA and Sekoia.
- Response: IOCs published.