APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery
Essential information
- Published
- 21/08/2025 21:05
- Modified
- 21/08/2025 21:35
- Tags
- 2025-08-21 apt36 ctfuft google drive icon data linux desktop persistence stealth stealth server syscall unix timestamp websocket
- Related entities
- 6 observables, 3 others
Description
Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.