APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems

According to CYFIRMA, the advanced threat group APT-36 is hacking government systems by peddling a fake “Fraudulent WhatsApp Messages” advisory. The campaign starts with victims receiving a lure named NCERT-Whatsapp-Advisory.pdf, which is actually a malicious Windows shortcut (.lnk) file designed to trigger a hidden command prompt and download an MSI payload.

The attackers employ command-line obfuscation, inserting caret symbols between letters to evade casual antivirus inspection, while a decoy PDF titled “NCERT Advisory: Fraudulent WhatsApp Message Campaign” is opened to keep the victim distracted. The malware deploys a .NET-based loader that performs DLL hijacking, creates a hidden HTA to modify the Windows Registry, and communicates with C2 servers using reversed endpoints such as /retsiger, with the (inactive) C2 domain wmiprovider[.]com noted in the analysis.

The report warns that the threat enables long-term access and remote command execution, indicating continued use of trusted advisory-themed lures in espionage campaigns. December 24, 2025.