Follow us on Google News
In a major cybersecurity concern for India, intelligence and defence establishments have been placed on high alert following revelations of a cyber-espionage campaign launched by Pakistan-linked threat group Transparent Tribe (APT36). The group has reportedly targeted Indian government and military computers using a newly developed spyware known as ‘DeskRAT’.
https://the420.in/centre-for-police-technology-launched-as-common-platform-for-police-oems-and-vendors-to-drive-smart-policing/
What Happened
According to cybersecurity researchers, Transparent Tribe — a Pakistan-based Advanced Persistent Threat (APT) group — has intensified attacks against Indian defence and government entities. Their latest operation leverages malicious ZIP files distributed via spear-phishing emails, which upon execution, deploy the DeskRAT remote-access trojan into the victim’s system.
The malware grants complete remote control to the attackers, enabling them to steal sensitive documents, run commands, and maintain long-term access to compromised systems.
How the Malware Works
Experts revealed that the phishing emails mimic legitimate defence communications and often carry titles such as “CDS Directive Armed Forces.pdf” or other official-sounding names. The ZIP archives contain malicious .desktop dropper files, primarily aimed at Linux-based systems, including the Indian government’s own Bharat Operating System Solutions (BOSS) distribution.
Once executed, the malware installs itself stealthily, sets up persistence mechanisms through cronjobs or systemd units, and communicates with its command-and-control (C2) servers via WebSockets — a technique rarely used in such state-sponsored attacks.
Strategic & Security Implications
This latest cyber operation highlights how state-sponsored threat actors are increasingly shifting their focus to Linux environments, which were earlier considered more secure. The use of Golang-based malware like DeskRAT demonstrates the technical advancement of Transparent Tribe, known for targeting Indian defence, research, and diplomatic sectors since 2013.
Security experts believe the motive behind this campaign is strategic intelligence gathering, not financial gain — suggesting attempts to infiltrate sensitive government networks and extract classified data relevant to India’s military preparedness and diplomatic operations.
Indian Agencies on High Alert
Indian cyber agencies including the National Technical Research Organisation (NTRO) and CERT-In have reportedly flagged the malware campaign and advised all departments handling defence or national security data to strengthen monitoring systems, especially on Linux servers.
Authorities have issued advisories to scrutinize email attachments, avoid unverified ZIP archives, and monitor for indicators of compromise (IoCs) shared by global threat-intelligence firms.
Recommended Safeguards
Cybersecurity experts have recommended the following steps to mitigate the threat:
- Conduct regular security audits of Linux-based systems.
- Deploy endpoint monitoring to detect creation of suspicious cronjobs or systemd services.
- Use updated anti-phishing tools and firewalls.
- Conduct user-awareness sessions for officials likely to receive spear-phishing emails.
- Keep systems and open-source distributions like BOSS OS regularly patched.
The Bigger Picture
The Transparent Tribe campaign is another reminder of how cyber warfare between India and Pakistan has moved beyond propaganda and defacement to direct espionage. As India pushes for digital sovereignty and indigenous operating systems for official use, experts warn that “security by obscurity” is not enough — continuous testing and real-time monitoring are critical.
