Beyond Windows: Pakistan's APT36 Group Is Now Attacking Linux Systems with Stealthy Malware

The Pakistan-linked threat group APT36—also known as Transparent Tribe, Mythic Leopard, Earth Karkaddan, or Operation C-Major—has re-emerged with a Linux-targeted campaign, leveraging Linux .desktop files and Google Drive-hosted payloads to bypass defences and gain persistence, according to CloudSEK.

The campaign begins with phishing emails containing ZIP archives that hold malicious .desktop files disguised as PDF documents, such as PROCUREMENT_OF_MANPORTABLE_&_COMPAC.pdf[.]desktop, which hides a malicious execution command.

When run, the loader downloads a dropper payload from Google Drive, stored there as hex-encoded strings, and the infection chain includes decoding the payload into the /tmp directory, granting execute permissions, and running the binary in the background while a decoy PDF is opened in Firefox to distract the victim.

The final payload is a Go-based ELF binary that establishes a C2 connection via WebSockets to seemysitelive[.]store and 164.215.103[.]55 (ASN: AS213373, IP Connect Inc), with the WebSocket URL ws://seemysitelive[.]store:8080/ws being repeatedly attempted. Researchers note that APT36 has targeted Indian government and defence personnel for years, and the use of Google Drive marks an evolution in their capabilities.