APT36 Uses Linux Desktop Lures and Poseidon Backdoor in Campaign Targeting India

Jul 31, 2025 · Original article ↗

Summary

Researchers detail APT36 infection chains using Linux .desktop files disguised as PDFs, cron-based persistence, Mythic-based Poseidon malware, and more than 100 phishing domains impersonating Indian government organizations.

Key points

Two attack variants use .desktop files disguised as PDFs to run scripts that download malware.
The infection chains establish persistence with cron jobs and disguise payloads with legitimate-sounding filenames.
Both variants deliver Poseidon, a Go-based backdoor built with the Mythic framework that supports persistent access and lateral movement.
The variants use separate command-and-control setups, including one with two redundant servers.
Researchers identified more than 100 phishing domains impersonating Indian government and defense organizations; many were associated with AlexHost infrastructure.
The article reports that phishing infrastructure was observed active in July 2025 and assesses the activity as likely linked to APT36.
Suggested defenses include monitoring listed C2 indicators, detecting suspicious .desktop files, and blocking lookalike government domains.

Article Details

Attack Vectors: APT36 used .desktop files disguised as PDF documents to execute scripts that downloaded malware.
The attackers used phishing domains impersonating Indian government organizations to deliver decoy documents and collect credentials.
Downloaded payloads were given names resembling legitimate system files, including p7zip-full, tcl-8.7, emacs-bin, and crond-98.
Defensive Notes: Monitor network traffic to the reported C2 IP addresses.
Detect .desktop files posing as PDFs in user downloads and investigate suspicious cron jobs and payloads.
Block confirmed phishing domains and investigate access to suspicious subdomains such as *.gov.in.nominationdrdo.report.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`37-221-64-252[.]cprapid[.]com`	Listed as a suspicious IP-based domain, described as likely malicious.
DOMAIN	`accounts[.]mgovcloud[.]in[.]cloudshare[.]digital`	Listed as a spoofed government-related domain.
DOMAIN	`accounts[.]mgovcloud[.]in[.]indiagov[.]support`	Listed as a fake government domain.
DOMAIN	`accounts[.]mgovcloud[.]in[.]storagecloud[.]download`	Listed as a spoofed government-related domain.
DOMAIN	`dayenter[.]shop`	Listed among suspicious domains associated with the phishing infrastructure.
DOMAIN	`dmsupport[.]live`	Listed among suspicious domains associated with the phishing infrastructure.
DOMAIN	`drdo[.]gov[.]in[.]nominationdrdo[.]report`	Phishing domain impersonating the Indian DRDO portal, used to deliver a decoy document and likely collect credentials.
DOMAIN	`email[.]gov[.]in[.]briefcases[.]email`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]defencedept[.]work`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]defenceindia[.]ltd`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]departmentofdefence[.]de`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]departmentofspace[.]info`	Listed as a phishing domain spoofing the Department of Space.
DOMAIN	`email[.]gov[.]in[.]indiadefencedepartment[.]link`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]indiandefence[.]work`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]indiangov[.]download`	Listed as a fake government email domain.
DOMAIN	`email[.]gov[.]in[.]ministryofdefenceindia[.]org`	Listed as a phishing domain spoofing government email.
DOMAIN	`email[.]gov[.]in[.]modindia[.]link`	Listed as a fake government email domain.
DOMAIN	`iaf[.]nic[.]in[.]ministryofdefenceindia[.]org`	Listed as a phishing domain impersonating the Indian Air Force.
DOMAIN	`indianarmy[.]nic[.]in[.]ministryofdefenceindia[.]org`	Listed as a fake domain impersonating the Indian Army.
DOMAIN	`indianarmy[.]nic[.]in[.]nominationdrdo[.]report`	Listed as a phishing domain impersonating the Indian Army.
DOMAIN	`jkpolice[.]gov[.]in[.]kashmirattack[.]exposed`	Listed as a fake Jammu and Kashmir Police domain.
DOMAIN	`mea[.]gov[.]in[.]indiandefence[.]services`	Listed as a phishing domain impersonating the Ministry of External Affairs.
DOMAIN	`mod[.]gov[.]in[.]defencepersonnel[.]support`	Listed as a phishing domain spoofing mod.gov.in.
DOMAIN	`mod[.]gov[.]in[.]indiandefence[.]directory`	Listed as a phishing domain spoofing the Ministry of Defence.
DOMAIN	`mod[.]gov[.]in[.]indiandefence[.]services`	Listed as a phishing domain spoofing the Ministry of Defence.
DOMAIN	`mod[.]gov[.]in[.]modpersonnel[.]support`	Listed as a phishing domain spoofing the Ministry of Defence.
DOMAIN	`www[.]email[.]gov[.]in[.]defenceindia[.]ltd`	Listed as a fake government email domain.
DOMAIN	`www[.]email[.]gov[.]in[.]indiandefence[.]work`	Listed as a fake government email domain.
DOMAIN	`www[.]email[.]gov[.]in[.]modindia[.]link`	Listed as a fake nested government email domain.
DOMAIN	`www[.]mnscare[.]live`	Listed among suspicious domains associated with the phishing infrastructure.
DOMAIN	`www[.]mod[.]gov[.]in[.]indiandefence[.]services`	Listed as a phishing domain spoofing the Ministry of Defence.
IPV4	`165[.]22[.]251[.]224`	Redundant C2 server used in attack Variant 2.
IPV4	`165[.]232[.]114[.]63`	C2 server used in attack Variant 2.
IPV4	`178[.]128[.]204[.]138`	Poseidon backdoor C2 server.
IPV4	`209[.]38[.]203[.]53`	C2 server used in attack Variant 1.
IPV4	`37[.]221[.]64[.]202`	Hosting IP to which the phishing domain drdo[.]gov[.]in[.]nominationdrdo[.]report resolved.
IPV4	`64[.]227[.]189[.]57`	Poseidon backdoor C2 server; Mythic C2 was detected on port 7443.
IPV4	`99[.]83[.]175[.]80`	Reported as an IP associated with the phishing domain drdo[.]gov[.]in[.]nominationdrdo[.]report.
MD5	`589cf2077569b95178408f364a1aa721`	Hash of an APT36 .desktop file used for initial compromise.
MD5	`5c71c683ff55530c73477e0ff47a1899`	Hash of an APT36 file masquerading as an official form and executing embedded payloads.
MD5	`6065407484f1e22e814dfa00bd1fae06`	Hash of an APT36 .desktop file using long sleeps and debug-environment checks.
MD5	`65167974b397493fce320005916a13e9`	Hash of an APT36 launcher disguised as a document shortcut to run secondary payloads.
MD5	`76e9ff3c325de4f2d52f9881422a88cb`	Hash of a malicious .desktop file with embedded scripts used by APT36.
MD5	`8d46a7e4a800d15e31fb0aa86d4d7b7f`	Hash of an APT36 phishing lure that launches a backdoor.
MD5	`b3f57fe1a541c364a5989046ac2cb9c5`	Hash of an APT36 malicious shortcut used for Linux-based targeting.
MD5	`e354cf4cc4177e019ad236f8b241ba3c`	Hash of a malicious .desktop file used by APT36 to impersonate a document and deliver payloads.
SHA256	`8441601f4bb59f529ff1130bd308b94d0a0785f660193f6a7a748071913f9045`	Resource hash associated with suspicious phishing infrastructure and used to identify more domains hosting or referencing similar phishing content.