Bitdefender Reports APT36 Using AI-Generated ‘Vibeware’ Against Indian Government Targets
Summary
Bitdefender reports that APT36 is using high volumes of low-quality, AI-assisted malware against Indian government and diplomatic targets, including browser-data theft, modified shortcut lures, and cloud services for instructions and exfiltration.
Key points
- Bitdefender attributes the campaign to APT36, also known as Transparent Tribe, and reports that it targets Indian government networks and diplomatic missions.
- The researchers describe a high-volume approach using AI-assisted malware written in Nim, Zig, and Crystal; some samples are reportedly broken or incomplete.
- LuminousCookies attempts to bypass Chrome and Edge App-Bound Encryption by injecting into browser memory to access saved credentials.
- Modified browser shortcuts can launch spyware in the background; a fake resume PDF is among the reported lures.
- The campaign reportedly uses Google Sheets for instructions and Slack or Discord to send stolen files.
- BackupSpy scans drives and USB devices for 16 file types and keeps a manifest of files it finds.
- Researchers found the name “Kumar” in file paths and an anime reference in a Discord server name, which they say may be intended to misdirect investigators.
Article Details
- Event Type
- Reported cyber-espionage campaign using AI-generated malware against Indian government networks and diplomatic missions.
- Impact
- The campaign reportedly uses spyware to target browser credentials and documents, and uses Google Sheets, Slack, and Discord for command-and-control and sending stolen files. Researchers say many samples are low quality or broken; the article does not confirm successful theft or a specific breach.
Threat Actors
APT36The article attributes the reported campaign against Indian government networks and diplomatic missions to APT36.Transparent TribeThe article identifies Transparent Tribe as another name for APT36 and attributes the reported campaign against Indian government networks and diplomatic missions to the group.
Malware
BackupSpyThe campaign uses niche languages like Nim, Zig, and Crystal, leverages Google Sheets and Discord for C2, and deploys intrusive tools such as LuminousCookies and BackupSpy to steal credentials and documents.LuminousCookiesThe campaign uses niche languages like Nim, Zig, and Crystal, leverages Google Sheets and Discord for C2, and deploys intrusive tools such as LuminousCookies and BackupSpy to steal credentials and documents.
Products
DiscordThe campaign uses niche languages like Nim, Zig, and Crystal, leverages Google Sheets and Discord for C2, and deploys intrusive tools such as LuminousCookies and BackupSpy to steal credentials and documents.Google ChromeWe usually trust our desktop icons, but APT36 is exploiting this trust by modifying shortcuts for Google Chrome and Microsoft Edge.Google SheetsThe campaign uses niche languages like Nim, Zig, and Crystal, leverages Google Sheets and Discord for C2, and deploys intrusive tools such as LuminousCookies and BackupSpy to steal credentials and documents.Microsoft EdgeWe usually trust our desktop icons, but APT36 is exploiting this trust by modifying shortcuts for Google Chrome and Microsoft Edge.SlackCommand-and-control and exfiltration use Google Sheets, Slack, and Discord, while BackupSpy scans 16 file types and keeps a manifest of stolen files.
Countries
IndiaResearchers found a common Hindu name, “Kumar,” hidden inside the code’s file paths, suggesting the developers are planting digital crumbs to trick investigators into looking for a culprit within India.PakistanA Pakistan-based hacking group, APT36, is flooding Indian government networks with a new wave of low-quality, AI-generated malware—what Bitdefender calls “Vibeware”—to overwhelm defenders by sheer volume.