Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign

APT36, a Pakistan-linked threat actor, is targeting Indian government and defense entities using Linux .desktop files to deploy custom malware for espionage. Their latest campaign involves spear-phishing emails with a malicious archive disguised as a PDF, which executes hidden commands to download and run malware. This malware ensures persistence and stealth by masquerading as a benign PDF while connecting to a command and control server for data exfiltration.

APT36 has been active since at least 2013, previously targeting Indian diplomats and military personnel, and has expanded its operations to various sectors and countries.