The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts

According to CYFIRMA, a prominent state-aligned threat actor known as APT36 (Transparent Tribe) has evolved from targeting Windows to Linux, deploying tailored malware against Indian government-sector Linux environments and adopting a dual-platform delivery to maintain covert access.

The intrusion begins with a spear-phishing email carrying a malicious archive named Analysis_Proc_Report_Gem_2025.zip, inside which a weaponised Linux shortcut file, Analysis_Proc_Report_Gem.desktop, silently downloads and runs malicious components in the background while showing benign content.

The core payload, swcbc, is a 64-bit ELF binary described as a Python-based Remote Administration Tool (RAT) compiled with PyInstaller, with cross-platform logic that hides in ~/.swcbc on Linux but installs in %USERPROFILE%\\swcbc and persists via a user-level systemd service and Registry modifications on Windows. The RAT offers capabilities such as arbitrary command execution, file exfiltration and screen capture, providing real-time visual monitoring of the victim’s desktop.

Infrastructure tied to the campaign includes the domain lionsdenim[.]xyz and the IP 185.235.137[.]90 (Germany) used for payload delivery. The move signals a significant escalation in regional cyber-espionage targeting India’s indigenous platforms. The report notes the campaign’s increasing sophistication and rapid deployment of tailored payloads.