Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government

Pakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign dressed as NIC eEmail Services. The operation relies on lookalike domains and weaponized infrastructure to harvest credentials and enable long-term espionage, beginning with emails that mimic official NIC notifications.

Victims are directed to a fake login portal branded as “NICeMail Services” to capture email addresses and passwords, with a login page closely mimicking NIC’s legitimate webmail interface. The malicious setup includes domains and servers linked to recent APT36 activity, such as accounts.mgovcloud.in.departmentofdefence[.]live and departmentofdefence[.]live, as well as IP addresses 81.180.93[.]5 and 45.141.59[.]168, the latter potentially hosting payloads or C2 communications.

According to the National Informatics Centre, security experts urge vigilance, blocking the identified domains and IPs, educating users on spear-phishing indicators, and implementing multifactor authentication to curb credential abuse and anomalous logins as part of a broader defence against this persistent espionage threat.