CYFIRMA Research- APT36 Phishing Campaign Targets Indian Defense Using Credential-Stealing Malware

CYFIRMA Research

Cyber Threat Alert: APT36 Targets Indian Defense with a Sophisticated Phishing Campaign!
CYFIRMA has uncovered a targeted cyber-espionage operation by APT36 (Transparent Tribe), a Pakistan-based threat actor. This group is exploiting phishing emails embedded with malicious PDFs mimicking official NIC documents to infiltrate Indian defense systems.
What’s Happening:
· Victims receive a fake “protected” PDF (PO-003443125.pdf).
· Clicking the button redirects to a fraudulent site, downloading a disguised malware-laden ZIP file.
· Upon execution, the malware conducts credential theft, data exfiltration, and persistent access.
· Uses anti-debugging, fileless execution, and clipboard/keylogging techniques.
· Communications were observed with low-reputation C2 domains via encrypted channels.
Key Défense Recommendations:
· Enforce file extension visibility on endpoints.
· Train personnel to detect phishing lures.
· Monitor for anomalous process trees and network traffic.
· Apply proactive threat hunting and behavior-based detection.
APT36’s campaign is a stark reminder of the evolving sophistication of state-sponsored cyber threats. Awareness, detection, and rapid response remain our best defenses.

Link to the Research Report: https://www.cyfirma.com/research/apt36-phishing-campaign-targets-indian-defense-using-credential-stealing-malware/

#CyberSecurity #APT36 #Phishing #ThreatIntel #India #Defense #Infosec #TransparentTribe #CYFIRMA #MalwareAlert #CYFIRMA #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/