Pakistani-Aligned APT36 Targets Indian Defense Organizations

A politically motivated hacking group aligned with Pakistani interests is matching the Indian military’s shift away from the Windows operating system with a heavy focus on malware encoded for Linux.

See Also: Live Webinar | Digital Doppelgängers: The Dual Faces of Deepfake Technology

Ministry of Defense said last year it will replace Windows with an Ubuntu fork named Maya bundled with an endpoint detection and protection system dubbed Chakravyuh, India media reported. Initial rollout occurred within the ministry with later planned expansion to military services, a ministry official told reporters in August (see: Indian Defense Ministry to Replace Windows With Local OS).

Researchers at BlackBerry Threat Research and Intelligence team said Wednesday they observed the cyberespionage group tracked as APT36 shifting to “focus heavily on the distribution of Executable and Linkable Format (ELF) binaries.” ELF is a widely used Linux executable file format specification.

The cyberespionage group, also tracked as Transparent Tribe and Earth Karkaddan, deployed an arsenal of espionage and data exfiltration tools compatible with the Linux platform in a majority of attacks – a trend also previously observed by cybersecurity company Zscaler.

BlackBerry observed the cyberespionage group undertaking a cluster of activities targeting government agencies and the defense and aerospace industries starting in late 2023 through April in a campaign that’s likely to persist. The group’s connection to the Pakistani government isn’t certain, but researchers widely agree that a Pakistani intelligence connection is likely.

BlackBerry researchers said they found embedded within a spear phishing email a remote IP address associated with a Pakistani-based mobile network operator. A time zone variable in a malicious script was set to Pakistani Standard Time. A malicious file, likely an initial test, “was submitted from Multan, Pakistan.” The group’s long-term targeting of the Indian military and defense industrial base also suggests “potential alignment with Pakistan’s interests.”

Researchers said the cyberespionage group used email as a vector for spear-phishing attacks and also used popular web services such as Telegram, Discord, Slack and Google Drive to store and distribute lures and malware. The timing of each attack was strategic, indicating that the hackers conducted detailed planning and had specific targets in mind when launching each attack.

For the first time since researchers began tracking APT36 operations, the group used ISO images as attack vectors. It also used ISO images in spear phishing emails to target Indian Air Force officials at a time when the government announced tenders to purchase fighter aircraft and upgrade dozens of Sukhoi 30MKI fighter jets.

BlackBerry said the espionage group mimicked the web domains of Indian defense and strategic think tanks and government agencies to lure victims into downloading malicious lure documents. These organizations included New Delhi-based independent think-tank Center for Land Warfare Studies, India’s Computer Emergency Response Team, and the Army Welfare Education Society.

“Over the course of 16 months the group has stood up multiple domains bearing a striking resemblance to numerous legitimate Indian domains, most featuring a top-level domain (TLD) of ‘.in,’ BlackBerry said.

Among the malicious scripts it delivered was Python code compiled into ELF binaries, which had minimal detection on VirusTotal. The binaries opened a PDF lure from Google Drive and downloaded a variation of a custom-built file exfiltration file for Linux already associated with APT36 known as Globshell.