Rising Threat: Transparent Tribe’s Latest Spear-Phishing Campaign in India

Peter Tomy

6 months ago

A cyber espionage group known as Transparent Tribe (also referred to as APT36) has carried out a new phishing campaign targeting Indian government entities. The Hacker News
The attackers used spear-phishing emails containing malicious shortcut files (e.g. .desktop files on Linux, Windows shortcut files) disguised as legitimate documents like meeting notices. The Hacker News
When opened, these files download malware, execute scripts, and stealthily establish a backdoor connection to command-and-control (C2) servers, enabling data theft and persistent access. The Hacker News
The campaign also targets systems running BOSS Linux (an Indian government OS) in addition to Windows. The Hacker News

These attacks are more sophisticated than “typical phishing” because they:
1. Use file types that seem harmless (or look familiar), so people are more likely to open them. The Hacker News
2. Operate cross-platform (Linux + Windows), meaning larger attack surface. The Hacker News
3. Aim at government infrastructure — making the potential damage high (loss of sensitive data, compromising national security). The Hacker News+1
It reflects a trend: phishing is no longer just mass spam emails asking for credentials; it’s increasingly custom-made, using social engineering, lookalike domains, and malware payloads. The Hacker News+1

Ahead of India’s 79th Independence Day, organized phishing, fake websites, scams and coordinated credential theft campaigns were observed targeting government, finance and defense sectors. cloudsek.com
There was also a fake shopping-portal phishing ring busted by the police in Patna, where several ATM cards and related devices were seized. Digital Forensics Magazine

If you are an individual, organization, or government entity, here are important steps to protect against such phishing attacks:

Area	Action Items
Email hygiene	Don’t open emails from unknown senders, especially attachments or links. Check file types: PDFs shouldn’t come as `.desktop` or disguised shortcut files.
Verify domains	Be wary of lookalike domain names (typo-squatting). If an email claims to be from government or a trusted institution, check carefully.
Multi-factor authentication (MFA)	Even if credentials are stolen, MFA adds a layer that can prevent full access.
Update OS & software	Apply security patches, especially on endpoints. If using Linux (especially government variants), ensure they are current.
User training	Train staff/government employees to recognize phishing attempts and suspicious behavior. Simulations help.
Incident response plan	Have tools and protocols ready to isolate compromised systems, change credentials, track malware. Report breaches quickly to cyber-security authorities.

Phishing attacks are evolving with the use of weaponized files, custom malware, and targeting less obvious platforms (like Linux) in addition to Windows. The Hacker News
Hacktivist and state-linked actors see geopolitically charged dates/events (national holidays, security incidents) as opportunities to launch escalated campaigns. cloudsek.com
Research shows emerging techniques such as QR-based phishing (Quishing), browser-in-the-browser attacks, and the use of AI/LLMs to craft more convincing messages. arXiv+2CYFIRMA+2

Whether government entities will accelerate adoption of hardened email filtering and endpoint detection tools.
Regulatory response: stricter cyber laws, mandatory reporting, more oversight on digital identity verification.
Development of tools to detect malicious files/disguised shortcuts proactively.
Public awareness campaigns, especially in vulnerable provinces or among user groups less familiar with IT security.