CloudSek Finds Hacktivist Claims Against India Overstated, Details APT36’s Crimson RAT Campaign

May 11, 2025 · Original article ↗

Summary

CloudSek says many hacktivist claims against Indian targets were exaggerated or unsupported, while detailing APT36’s phishing campaign using Crimson RAT to target government and defense networks.

Key points

CloudSek found that many claimed attacks caused little or no disruption; several alleged leaks contained public, recycled, fabricated, or misattributed data.
A sample offered as proof of a 247 GB National Informatics Centre breach was largely public marketing and media material; an Andhra Pradesh High Court dataset reportedly included some password hashes.
APT36 used Pahalgam-attack-themed phishing emails and attachments to deliver Crimson RAT to Indian government and defense targets.
The campaign used malicious PowerPoint add-ins with macros and PDFs linking to credential-theft pages, including the spoofed domain jkpolice.gov.in.kashmirattack[.]exposed.
Crimson RAT can capture screenshots, access and download files, execute commands, and persist across reboots; it communicates with a hardcoded C2 server at 93.127.133.58:1097.
CloudSek describes the malware’s tactics as largely unchanged over roughly six years and assesses the campaign as a limited threat to organizations with mature security controls.

Article Details

Attack Vectors: Hacktivist groups claimed DDoS attacks, website defacements, and data breaches against Indian government, education, medical, judicial, and other organizations; CloudSek reports that many claims were unsubstantiated or caused negligible disruption.
APT36 used phishing emails with malicious PowerPoint add-on files containing macros and PDFs embedding links to spoofed credential-phishing pages to deliver Crimson RAT.
The article reports that Crimson RAT was disguised as an image file, which launched an executable payload after user interaction.
A social media account attributed an Airtel attack to exploitation of a BIG-IP service and a Trackmaster breach to exploitation of a known vulnerability followed by image upload; these claims are presented as reported claims.
A named individual claimed to conduct intrusions by exploiting server vulnerabilities or using compromised credentials.
Defensive Notes: The article says basic DDoS hygiene is usually sufficient to mitigate the low-impact DDoS activity described.
The article characterizes Crimson RAT as a limited threat to organizations with mature security policies, while identifying government endpoints and ordinary citizens as intended victims.
The article describes malicious macros, spoofed credential-phishing domains, disguised payloads, and persistence as parts of the APT36 campaign.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`email[.]gov[.]in[.]departmentofdefence[.]de`	APT36 campaign spoofed domain used to support credential phishing and malware delivery.
DOMAIN	`iaf[.]nic[.]in[.]ministryofdefenceindia[.]org`	APT36 campaign spoofed domain used to support credential phishing and malware delivery.
DOMAIN	`indianarmy[.]nic[.]in[.]departmentofdefence[.]de`	APT36 campaign spoofed domain used to support credential phishing and malware delivery.
DOMAIN	`jkpolice[.]gov[.]in[.]kashmirattack[.]exposed`	Spoofed domain hosting a fake Jammu & Kashmir Police login page for credential theft.
IPV4	`93[.]127[.]133[.]58`	Crimson RAT hardcoded command-and-control server.