Pakistan-Linked TransparentTribe APT Deploys AI-Assisted DeskRAT Malware Against India’s BOSS Linux Systems

According to Sekoia, the Pakistan-linked TransparentTribe APT has shifted its Linux targeting to Bharat Operating System Solutions (BOSS) distributions used by Indian government interests, with activity happening between August and September 2025. The campaign delivers a Golang-based remote access trojan named DeskRAT, which establishes WebSocket-based communication with three C2 endpoints: ws://147.93.155[.]118:8080/ws, ws://newforsomething[.]rest:8080/ws, and ws://seeconnectionalive[.]website:8080/ws.

Phishing emails carry ZIP archives hosted on staging domains such as modgovindia[.]com, and upon execution a .desktop file masquerades as an official Ministry of Defence document, launching a Bash one-liner that downloads and runs the DeskRAT payload while opening a decoy PDF.

The RAT provides file browsing, document exfiltration under 100MB, arbitrary file upload and execution, and persistence via systemd services, cron jobs, and GNOME autostart entries, with a web-based Advanced Client Monitoring & File Management System for operator control. The malware’s development appears to be AI-assisted, with uniform internal function names suggesting prompt-driven Golang implementation, a finding highlighted by Sekoia as part of TransparentTribe’s evolving toolset.