TransparentTribe Targets Linux Systems in Indian Military to Deploy DeskRAT

In July 2025, cybersecurity firm CYFIRMA uncovered an active phishing campaign targeting Linux-based operating systems used by Indian government and military organisations, attributed to TransparentTribe, also known as APT36 or Operation C-Major. The operation, which began its initial wave in June 2025, is designed to compromise devices running the Bharat Operating System Solutions (BOSS) distribution that is mandated across many Indian government agencies.

The campaign’s infection chain starts with phishing emails containing a malicious ZIP archive, with the ZIP named MoM_regarding_Defence_Sectors_by_Secy_Defence_25_Sep_2025.zip, which delivers a DESKTOP file that triggers a multi-stage Bash one-liner to download and execute a base64 payload.

DeskRAT, a Golang remote access trojan delivered by this campaign, supports Linux-specific persistence methods such as systemd services, crontab scheduling, autostart desktop files, and startup scripts, and communicates with C2 servers via unsecured WebSocket. The campaign also uses decoy documents like CDS_Directive_Armed_Forces.pdf and timing tied to protests to entice Indian defence personnel, while attackers reportedly leverage stealthy staging servers and context-aware lures to increase effectiveness.