The Pakistan-linked Advanced Persistent Threat (APT) group APT36, also known as Transparent Tribe, has significantly expanded its cyber operations beyond traditional military targets to encompass critical Indian infrastructure including railway systems, oil and gas facilities, and key government ministries. The researchers uncovered two distinct attack variants, each employing separate command and control infrastructure to maintain operational security and provide redundancy against defensive countermeasures. The campaign specifically targets high-value entities including the Ministry of External Affairs, Indian Railways infrastructure, and energy sector organizations, indicating a strategic focus on disrupting critical national services. The attack methodology centers on the deployment of the Poseidon backdoor, a sophisticated malware built on the open-source Mythic command and control framework using the Go programming language. This escalation represents a concerning shift in the threat landscape, as the group demonstrates increasingly sophisticated attack methodologies designed to penetrate and persist within India’s most sensitive operational networks. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The threat actors have refined their attack arsenal by weaponizing seemingly innocuous PDF documents through a deceptive technique involving malicious .desktop files. Upon execution, these files deploy sophisticated evasion techniques including extended sleep timers and environment detection to bypass dynamic analysis systems. Malicious payloads are strategically placed in system directories using names like “emacs-bin” and “crond-98” to blend with legitimate system processes, significantly complicating detection efforts. This illustrates the first attack variant’s execution flow, while the second one shows the redundant infrastructure approach of the second variant. The Poseidon backdoor communicates with dedicated C2 servers at 178.128.204.138 and 64.227.189.57, both hosted on DigitalOcean infrastructure, utilizing port 7443 for secure command transmission. This backdoor provides the attackers with comprehensive system access, enabling credential harvesting, lateral movement capabilities, and persistent surveillance of compromised networks.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 01 Aug 2025 12:05:24 +0000