CYFIRMA Details APT36 Malware Campaign Targeting Indian Government Entities
Summary
CYFIRMA reports a campaign attributed to Transparent Tribe (APT36) using ZIP lures, LNK files and a macro-enabled PowerPoint add-in to deploy a .NET RAT with raw TCP C2, persistence, screen monitoring and file-exfiltration capabilities.
Key points
- The report attributes a campaign targeting Indian government entities to Transparent Tribe (APT36); the supplied content does not independently confirm successful compromises.
- A ZIP archive disguised as examination documents contains a deceptive LNK shortcut and a macro-enabled PowerPoint add-in, Brief.ppam.
- The shortcut launches a batch script that stages files, presents decoy documents, removes Mark-of-the-Web, and starts the payload through a hard link.
- The add-in's VBA macro extracts embedded objects, reconstructs an executable, selects a payload based on the operating system, and launches it.
- The .NET RAT, hsuzoiaisaacrhy.exe, uses raw TCP C2 at 93.127.130.89 with sharemxme126[.]net as a fallback; it can establish startup-registry persistence, execute commands, transfer files, and capture or stream screens.
- The report describes obfuscation, hidden staging, randomized names, and a self-deleting executable, and recommends controls including macro restrictions, EDR monitoring, and behavior-based detection.
Article Details
- Attack Vectors
- A socially engineered ZIP archive disguised as examination-related documents contained a deceptive double-extension .lnk shortcut and a macro-enabled PowerPoint add-in.
- The shortcut launched a hidden batch script that staged files, displayed a decoy PDF, removed Mark-of-the-Web, created a hard link, and launched the RAT.
- The PowerPoint add-in's Auto_Open VBA macro copied and unpacked its container, extracted embedded objects, reconstructed a PE payload, and opened a decoy document.
- The RAT used raw TCP to communicate with a hardcoded C2 IP and an embedded fallback domain; it supported remote execution, screen capture and streaming, and file exfiltration.
- The malware established persistence through the current user's Windows Startup Registry key and used hidden staging, obfuscation, and a self-deleting cleanup executable.
- Defensive Notes
- Block or quarantine externally sourced archives containing executable content or shortcut files, and use attachment sandboxing.
- Restrict Office macros from internet-originated files and limit execution of shortcuts, scripts, and executables from user-writable directories.
- Display full file extensions and monitor execution chains involving shortcuts, batch scripts, PowerShell, hidden directories, hard links, and files staged in ProgramData or launched from AppData.
- Monitor outbound connections to the reported C2 indicators and integrate the campaign's hashes and YARA signature into detection systems.
- Alert on unauthorized removal of Mark-of-the-Web and suspicious creation or execution of randomly named files in user-profile directories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sharemxme126[.]net | Fallback C2 domain embedded in the RAT; reported as not registered at the time of analysis. |
| IPV4 | 93[.]127[.]130[.]89 | Hardcoded primary C2 IP; reported active at the time of analysis. |
| MD5 | 81d97473b2b87310b2caf3376341fba6 | MD5 hash reported for the malicious Approved Documents 2026.pdf.lnk shortcut. |
| MD5 | f3b4e186aa1e27455e9d870218e423a5 | MD5 hash reported for the malicious myscsd.bat script. |
| MD5 | ff1a302651019277d90c814c2e0940ec | MD5 hash reported for the malicious Brief.ppam add-in. |
| SHA256 | 34412e765822cf3fb32a5a5c9866fb29a9b98d627b4d9a3275fd3e754cf8e360 | SHA-256 hash listed as a campaign malware-component indicator. |
| SHA256 | 7725f32d6b9906ca653f43e9950fc9f6c914b7f2cd29a29b712c9e94dac55031 | SHA-256 hash listed as a campaign malware-component indicator. |
| SHA256 | 7b4e1670930ec33a673d9b32454f67f28af73a89958fcaba4b24ac2c799b1af1 | SHA-256 hash listed as a campaign malware-component indicator. |
| SHA256 | 9d88e2b6dda140befb2dc0e91a13ca8356b079671e24a486be966ce447d87438 | SHA-256 hash listed as a campaign malware-component indicator. |
MITRE ATT&CK
T1005 · Data from Local SystemThe operator can request files from the infected machine for chunked upload.T1027 · Obfuscated Files or InformationThe malware uses string and function-name obfuscation, randomized names, and junk code to hinder analysis.T1036.007 · Double File ExtensionThe shortcut is named Approved Documents 2026.pdf.lnk to make the .lnk file appear to be a PDF.T1041 · Exfiltration Over C2 ChannelThe report says file uploads and command results are transmitted back over the C2 channel.T1059.003 · Windows Command ShellThe shortcut invokes the Windows command interpreter to run the hidden batch script.T1059.005 · Visual BasicThe PowerPoint add-in uses an Auto_Open VBA macro to extract and reconstruct the payload.T1070.004 · File DeletionThe generated fimsrwvar.exe removes executable files in the target folder and then deletes itself.T1095 · Non-Application Layer ProtocolThe RAT establishes a direct raw TCP connection to its C2 server.T1113 · Screen CaptureThe RAT can capture screenshots and transmit them to its C2 server.T1204.002 · Malicious FileA user opening the deceptive .lnk shortcut or PowerPoint add-in triggers the infection chain.T1547.001 · Registry Run Keys / Startup FolderThe RAT adds itself to the current user's Windows Startup Registry key for execution at logon.T1553.005 · Mark-of-the-Web BypassThe batch script uses PowerShell Unblock-File to remove Mark-of-the-Web from a staged payload.T1564.001 · Hidden Files and DirectoriesThe batch script stages files in a hidden folder named '~' to conceal them from the user.T1566.001 · Spearphishing AttachmentThe report describes initial delivery through a socially engineered ZIP archive masquerading as examination documents.
Threat Actors
APT36The report explicitly identifies APT36 as another name for Transparent Tribe and attributes this malware campaign to the group.Transparent TribeThe campaign is attributed by CYFIRMA to Transparent Tribe, which the report describes as targeting governmental and defense-related entities for cyber espionage.
Products
Microsoft OfficeMaintain up-to-date patching of operating systems and commonly abused components, including Microsoft Office, scripting engines, and system utilities.Microsoft PowerPointthe malicious file. In addition, the archive includes a file named “Brief.ppam,” which is a Microsoft PowerPoint add-in containing embedded malicious macros designed to facilitate further stages of the attack.
Countries
Industries
DefenseAttackers used multiple defense-evasion techniques including string and code obfuscation, junk code insertion, randomized names, hidden staging directories, Mark-of-the-Web removal, hard links, and a self-deletingGovernmentcyber-espionage threat, with activities primarily focused on intelligence collection against Indian government-associated entities, defense-related organizations, and individuals of strategic relevance.