A threat actor based in Pakistan (APT36) has engaged in a sophisticated cyber-espionage campaign, according to intelligence from CYFIRMA. 

The threat actor is targeting individuals and organizations in the defense sector of India. The research has identified a shift in methodology from APT36, as the group is focusing on Linux-based environments, particularly on systems running BOSS Linux. Boss Linux is widely deployed by Indian government agencies. 

Shane Barney, Chief Information Security Officer at Keeper Security, states, “APT36’s focus on Linux-specific systems, particularly those used in government infrastructure, reinforces that no operating system is off-limits to nation-state attackers. This kind of multi-layered phishing attack highlights how threat actors are constantly evolving their tactics to quietly bypass defenses and exploit user trust.”

The research encourages organizations (especially those in the Indian defense sector) to take the following threat mitigation strategies: 

1. Enhance email security
2. Enact user security awareness and training
3. Secure systems
4. Monitor networks and endpoints
5. Integrate threat intelligence 
6. Patch systems and applications 
7. Utilize behavior-based detection rules

“To defend against these threats, organizations need a proactive, layered security approach that begins with locking down identity and access, ensuring that credentials are protected and privilege is tightly controlled. Endpoint visibility and behavioral monitoring are just as important, especially as attackers increasingly exploit legitimate tools like desktop shortcuts to mask their activity. Equally essential is equipping organizational team members to recognize the signs of phishing and unusual file behavior, as well as giving security teams the visibility and tools to act quickly when something doesn’t look right,” Barney explains. “These evolving campaigns are a reminder that the fundamentals still matter: strong authentication, least-privilege access, behavioral detection and threat-informed defense planning. Organizations that stay ahead of the curve in these areas are far better positioned to detect, contain and respond to attacks like this before damage is done.” 

What Is the Attack Vector? 

According to the findings, APT36 sends mass phishing emails that contain ZIP file attachments with a malicious .desktop file, working as a Linux shortcut. When executed by the target, the file will download and open a legitimate PowerPoint file as a diversion while downloading a malicious ELF (Executable and Linkable Format) binary. This ELF behaves as the primary payload and grants the threat actor unauthorized access. 

Jason Soroko, Senior Fellow at Sectigo, remarks, “Even a PowerPoint presentation has the power to help automate, but it should only do so when you know it’s legitimate. Prevention improves when BOSS Linux images disable auto execution of desktop shortcuts and enforce application allow lists that limit what runs outside signed repositories. PowerPoint viewers should open in read only mode and downloads from untrusted networks should land in a no execute mount. Zero-trust segmentation keeps a compromised workstation isolated from classified enclaves.” 

The multi-staged attack works by evading user detection and bypassing traditional security measures. This allows the threat actor to obtain persistent access to targeted environments. 

“This APT36 campaign shows exactly what happens when attackers recycle old tricks against less prepared targets,” states J Stephen Kowski, Field CTO at SlashNext Email Security+. “Most mature defense organizations already have solid file transfer policies that would block these ZIP attachments from even reaching users, but this attack specifically targets environments that haven't caught up with modern security practices yet. The real solution here is implementing automated email security that can detect these multi-stage attacks before they hit inboxes — technology that analyzes not just the initial ZIP file but also predicts what happens when users click on suspicious links or attachments. Organizations need systems that can spot when legitimate-looking PowerPoint files are being used as decoys while malicious code runs in the background, because that’s exactly the kind of sneaky behavior that fools people every time.”