APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

APT36, a Pakistan-nexus threat actor also known as Transparent Tribe, has been observed targeting Indian government entities as part of spear-phishing campaigns delivering a Golang-based DeskRAT malware, according to The Hacker News. The activity, observed in August and September 2025, builds on prior disclosure and has been attributed to Transparent Tribe, a state-sponsored group active since at least 2013.

Campaigns sent phishing emails containing a ZIP attachment or a link to a cloud-hosted archive (e.g., Google Drive), with the decoy PDF CDS_Directive_Armed_Forces.pdf opened to execute the main payload from an external server, modgovindia[.]com. DeskRAT is described as capable of establishing command-and-control via WebSockets and includes persistence options such as systemd services, cron jobs, autostart entries, and a bashrc-driven launcher.

The report also notes cross-platform references, including Windows StealthServer variants and Linux variants of DeskRAT with differing commands, highlighting a multifaceted, evolving threat ecosystem in the region.