Pakistan-Linked Campaign Uses GOGITTER, GITSHELLPAD and GOSHELL to Target Indian Government
Summary
ThreatLabz details the Gopher Strike campaign targeting Indian government entities with phishing PDFs, a Golang downloader and backdoor using private GitHub repositories, and a loader that deploys Cobalt Strike.
Key points
- ThreatLabz identified Gopher Strike in September 2025 and assesses with medium confidence that it may involve a new or parallel Pakistan-linked group.
- Spear-phishing PDFs use fake Adobe update prompts to deliver an ISO; payload servers restrict delivery to Windows users with IP addresses in India.
- GOGITTER drops a persistent VBScript downloader and fetches an archive from a private, actor-controlled GitHub repository.
- GITSHELLPAD uses private GitHub repositories for command-and-control, polling for commands and uploading results; researchers observed more than 200 post-compromise commands.
- GOSHELL checks for specific hostnames and decodes shellcode that loads a Cobalt Strike Beacon; its file is padded with junk bytes, likely to evade antivirus detection.
- Observed commands included user and system reconnaissance, downloading tools, and deleting files and processes.
Article Details
- Attack Vectors
- Spear-phishing PDFs reportedly contain links that prompt targeted users to download an ISO file containing a payload.
- GOGITTER downloads payloads from attacker-controlled infrastructure and a private GitHub repository; the ISO delivery servers reportedly restrict responses to requests from Indian IP addresses using a Windows User-Agent.
- GOGITTER establishes persistence by creating a scheduled task that runs windows_api.vbs every 50 minutes.
- GITSHELLPAD uses private GitHub repositories for command-and-control, receives commands, and uploads results and files.
- GOSHELL checks the victim hostname against a hardcoded list, then loads shellcode that deploys a Cobalt Strike Beacon.
- Defensive Notes
- Zscaler reports that its cloud security platform detects indicators related to GOGITTER, GITSHELLPAD, and GOSHELL.
- The article provides file hashes and network indicators for detection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | adobe-acrobat[.]in | Domain explicitly listed as payload-hosting and C2 infrastructure. |
| DOMAIN | adobecloud[.]site | Domain explicitly listed as payload-hosting infrastructure. |
| DOMAIN | adobereader-update[.]in | Domain explicitly listed as payload-hosting infrastructure. |
| DOMAIN | adobereader-upgrade[.]in | Domain explicitly listed as payload-hosting infrastructure. |
| DOMAIN | govt-filesharing[.]site | Domain explicitly listed as C2 infrastructure. |
| DOMAIN | ingov[.]myartsonline[.]com | Domain explicitly listed as C2 infrastructure. |
| DOMAIN | listsoft-update[.]site | Domain explicitly listed as C2 infrastructure. |
| DOMAIN | workspace1[.]myartsonline[.]com | Domain explicitly listed as C2 infrastructure. |
| HOSTNAME | d18c3nlvb0n2a6[.]cloudfront[.]net | Cobalt Strike Beacon C2 hostname reported in the extracted configuration. |
| MD5 | 0d86b8039cffc384856e17912f308616 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| MD5 | 10a7725f807056cb0383a1cae38d49b4 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| MD5 | 8577f613b3aec5c1c90118b15eea8756 | Hash listed for a phishing PDF used in the campaign. |
| MD5 | 9b9c574cdb17c238df80414476228a78 | Hash listed for a campaign PDF. |
| MD5 | b531b8d72561cb5c88d97986e450bbae | Hash listed for a phishing PDF used in the campaign. |
| MD5 | c876a70380738236ee28aab60a2cde6e | Hash listed for a campaign PDF. |
| MD5 | e26b3fece2fe296654406ef8045ffda1 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| MD5 | f2284f62625f117c57384b1c5b8b8f58 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| MD5 | f2a71b2719744765ac8a6a49b2acbce6 | Hash listed for a phishing PDF used in the campaign. |
| MD5 | f454e2724a63cbbfda26daff1d8bb610 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| MD5 | f4813d65cd7246f716fcbd8f7fd3e63d | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 0041636465cad79518a06d528e76393f442bf495 | Hash listed for a campaign PDF. |
| SHA1 | 3c17dbf975af8eb7a67e6908f522c93c2c0662e5 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 3d48ab9567c6080471459b34dfc12c89418be8a2 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 4c33100babea20749ff0957f50b174046bc6489d | Hash listed for a campaign PDF. |
| SHA1 | 54bfe1ffba8bff3571093ade5038dc98ef5f46ce | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 6036098059fa1311866ce6ad2723c4d0d1f00138 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 667785fdde357ae65a6668545c6c013190dc9368 | Hash listed for a phishing PDF used in the campaign. |
| SHA1 | 699329d64308a172c6cf7f83712215490fc0b604 | Hash listed for a phishing PDF used in the campaign. |
| SHA1 | 6a11c0e5f1d1e22e89b4921c7a371dbf9cf54709 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | 6d1dbd92f7ed7381c7bfca681c3139daeab692f1 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA1 | ccd0228e9c1bdb4c355d67c98a3233bb1fa085ac | Hash listed for a phishing PDF used in the campaign. |
| SHA256 | 03edba9908a2f9e1012237d216e894029bd58f9121027e35f80d7b701d30ca95 | Hash listed for a campaign PDF. |
| SHA256 | 23327fe1158c2e1229dfac028c461eb331686e5c5c04f33af7a042676806a962 | Hash listed for a campaign PDF. |
| SHA256 | 3f2a52ec2dd2d6614115687325f1da9e028937f8a16bccc347de8c71c3aa87e1 | Hash listed for a phishing PDF used in the campaign. |
| SHA256 | 5d9b2e61ed45b6407b778a18ff87792265fa068d7c4580ae54fbf88af435679f | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA256 | 6c60e5b28e352375d101eb0954fa98d229de3b94f22d5815af8948ebed1f44dd | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA256 | 7434a71a8302462d56fee876c74cf3595cba9f2ca6940b3a11ece8aa064fcbaa | Hash listed for a phishing PDF used in the campaign. |
| SHA256 | 8f495603be80b513820a948d51723b616fac33f0f382fa4a141e39e12fff40cf | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA256 | 95a2fb8b6c7b74a7f598819810ddb0a505f3d5cf392b857ff8e75c5a1401110e | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA256 | 99c3e908277df232d7170e1ea0697f79047c7f5610524bd11dc571fe4d84696b | Hash listed for a phishing PDF used in the campaign. |
| SHA256 | af01c12019a3a3aa64e8a99d7231e0f2af6084298733bba3d7d41db13091cbac | Hash of edgehost.exe, identified as GITSHELLPAD. |
| SHA256 | fff79ce90b1af67e0b6d16a850e85861c948f988eda39ef46457241bbe3df170 | Hash of edgehost.exe, identified as GITSHELLPAD. |
| URL | hxxp[:]//ingov[.]myartsonline[.]com/hpc5985[.]php?key=xvnd54&info=Hello | Fallback C2 URL used by the dropped VBScript. |
| URL | hxxp[:]//workspace1[.]myartsonline[.]com/hpc5985[.]php?key=xvnd54&info=Hello | C2 URL listed among the campaign's network indicators. |
| URL | hxxps[:]//adobe-acrobat[.]in/a[.]rar | URL used in an observed command to download a post-compromise archive. |
| URL | hxxps[:]//adobe-acrobat[.]in/adobe_reader_setup[.]php?file=Adobe_Acrobat_Reader_Installation_Setup | GOGITTER payload-download URL identified in the network indicators. |
| URL | hxxps[:]//adobe-acrobat[.]in/ninevmc987[.]php?file=bncoeeav34564cvv94adfavc3354334dfsf | C2/check-in URL contacted by GOGITTER after infection. |
| URL | hxxps[:]//adobecloud[.]site/adobe_installer[.]php?file=Adobe_Acrobat_Installer | GOGITTER payload-download URL identified in the network indicators. |
| URL | hxxps[:]//adobereader-upgrade[.]in/adobe_update[.]php?file=Adobe_Acrobat_Reader_Installation | GOGITTER payload-download URL identified in the network indicators. |
| URL | hxxps[:]//d2i8rh3pkr4ltc[.]cloudfront[.]net/adobe_installation[.]php?file=Adobe_Acrobat_Reader_Installation_Setup | GOGITTER payload-download URL identified in the network indicators. |
| URL | hxxps[:]//govt-filesharing[.]site/hpc5985[.]php?key=xvnd54&info=Hello | Primary C2 URL used by the dropped VBScript. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/jaishankai/sockv6/main/adobe_update[.]zip | URL to the attacker-controlled private GitHub repository hosting the GOGITTER payload archive. |
MITRE ATT&CK
T1053.005 · Scheduled TaskGOGITTER creates a scheduled task to run windows_api.vbs every 50 minutes.T1059.005 · Visual BasicGOGITTER creates a VBScript that polls C2 and executes returned VBScript commands.T1082 · System Information DiscoveryObserved post-compromise commands included systeminfo and queries for logical disks.T1087.001 · Local AccountObserved post-compromise commands included net user to collect user-account information.T1102.002 · Bidirectional CommunicationGITSHELLPAD uses GitHub REST API and private repositories to receive commands and send results and files.T1105 · Ingress Tool TransferGOGITTER downloads an archive and payloads, and the operators used cURL commands to download post-compromise tools.T1566.002 · Spearphishing LinkCampaign PDFs were reportedly sent in spear-phishing emails and contained malicious links prompting victims to download an ISO payload.
Malware
Cobalt Strike Beaconcommand-and-control (C2) communication, and GOSHELL, a Golang shellcode loader used to deploy a Cobalt Strike Beacon. The second part of the blog explores the Sheet Attack campaign, including the attack chain,GITSHELLPADcampaign, including the newly discovered GOGITTER tool as an initial downloader, a backdoor called GITSHELLPAD for command-and-control (C2) communication, and GOSHELL, a Golang shellcode loader used to deploy aGOGITTERis the first in a two-part series that covers the Gopher Strike campaign, including the newly discovered GOGITTER tool as an initial downloader, a backdoor called GITSHELLPAD for command-and-control (C2) communication,GOSHELLas an initial downloader, a backdoor called GITSHELLPAD for command-and-control (C2) communication, and GOSHELL, a Golang shellcode loader used to deploy a Cobalt Strike Beacon. The second part of the blog explores
Vendors
Products
Tools
Countries
Indiaan ISO file with a payload, ensuring delivery is restricted to targeted victims (Windows systems in India).Pakistanidentified two campaigns, tracked as Gopher Strike and Sheet Attack, by a threat actor that operates in Pakistan and primarily targets entities in the Indian government. In both campaigns, ThreatLabz identified