APT36 Threatens Indian Government Agencies with Custom Malware

APT36 is a highly sophisticated APT (Advanced Persistent Threat) group known for conducting targeted espionage in South Asia and is strongly linked to Pakistan.

While this APT group is known for targeting the following Indian sectors:

• Government
• Defense
• Education

Since 2013, this APT group has been active, and to conduct cyber espionage, it uses the following methods:-

• Credential harvesting
• Malware distribution

Here below, we have mentioned the resources used by APT36:-

• Custom-built remote administration tools targeting Windows
• Lightweight Python-compiled cyber espionage tools serving specific purposes targeting Windows and Linux
• Weaponized open-source C2 frameworks like Mythic
• Trojanized installers of Indian government applications like KAVACH multi-factor authentication
• Trojanized Android apps
• Credential phishing sites targeting Indian government officials

Zscaler analysts dubbed the Windows backdoor used by APT36 ‘ElizaRAT,’ because of unique strings in observed C2 commands.

The link for this article located at CyberSecurity News is no longer available.