Only one trip

Apt36 pakistan networks use Linux .DuscoP for malware charges in new attacks against government and defensive in India.

Activity documented in Cyphrima Reports and Rapid Blounskek if you continue apt 36 has previously loaded in the uninficientia intended in south Asia .Desktop.

The first attack occurred on August 1, 2025, and from the latest evidence, they continued.

Abuse of a desktop file

Although the attacks described in two reports are various infrastructures and patterns (TPTP) and the same thing.

The victims get zip ornaments of the nerves of the secret and hidden to a PSTF document and we call a PDF document and is called a PDF document and they call normal.

Linux

Users open the .Desktop file, which opens that 'EXEC = attackers or Google Drive is a PDF that causes' exec = a bash command to get a six -load load.

It then runs 'CHMOD + X' to run the background.

To reduce the assumption to the victim, the Firefox measurement script to indicate the Benin Decowee PDF file hosted on Google Drive.

To manage the spolp to manage your view order, "the professional experts, as long as ex -c = user" xnamelist.

Typically, no "I" sent to Linux, for murder, and the order of "No" files.

However, in the attack of 366, invaders have been transferred to the necessary malware malware and self-determination process, using this Launter Road by 'Lno' short-'shortcut.

Because the binary files in the linx is usually text, not binary files, and because their abusing files are widely authenticated, with the platform.

The payment was dropped from the acquired file. In this case the file decreased.

Although loading and chaos make the analysis challenge, researchers found that they could be organized to remain confidential, or try to control different endurance using Cron's function and system service.

Communication with C2 is carried out through the Bidirectional Channel of Websocket, allowing the exphilter data and the remote order.

Both Firems dreamed of this recent moment to become a symbol of evolution in an apt36 wave, which went to what is standing and returned.

Blue Message Picus 2025 Here: 2x Passed Password

46% of the environment cracked passwords, almost doubled for 25% last year.

Receive a Picus Blue 2025 to perform a thorough look at prevention, detection and information about the trends of rules.

Post of the Community Community Regulations

You have to log in to comment.

There is no member yet?Register now