A sophisticated attack campaigns Gopher Strike and Sheet Attack orchestrated by a Pakistan-linked threat actor with a specific focus on compromising Indian government entities.
The investigation revealed previously undocumented tools and techniques that represent a significant escalation in state-sponsored cyber operations targeting critical infrastructure and government systems in India.
The campaigns introduce three newly discovered malware components: GOGITTER, a Golang-based downloader; GITSHELLPAD, a lightweight backdoor that leverages GitHub repositories for command-and-control (C2) communication; and GOSHELL, a sophisticated shellcode loader designed to deploy the Cobalt Strike Beacon.
While the attack patterns share similarities with the known Pakistan-linked APT36 group, ThreatLabz assesses with medium confidence that the activity originates from either a new APT subgroup or a parallel Pakistan-linked threat actor operating independently.
The initial infection vector for Gopher Strike begins with spear-phishing emails containing malicious PDF attachments.
These PDFs employ social engineering tactics displaying blurred images of legitimate documents relevant to government officials alongside fake Adobe Acrobat update prompts.
When victims click the “Download and Install” button, an ISO file containing the malware payload is downloaded to their systems.
The threat actors implemented sophisticated geofencing and device detection measures to ensure payload delivery only reaches intended targets.
In September 2025, Zscaler ThreatLabz identified two campaigns, tracked as Gopher Strike and Sheet Attack.
The servers hosting the malicious ISO file only respond to download requests from IP addresses originating within India and from systems with Windows User-Agent headers.
This server-side validation prevents automated analysis tools from capturing the payload, creating a significant detection challenge for security researchers and endpoint detection systems.
GOGITTER: A New Golang Downloader
GOGITTER represents a previously undocumented lightweight 64-bit Golang downloader that establishes the initial foothold on compromised systems.
Upon execution, the malware creates a VBScript file named windows_api vbs across multiple user directories, establishing persistence through scheduled tasks executed every 50 minutes.
The malware polls two pre-configured C2 URLs every 30 seconds, fetching and executing VBScript commands from the threat actor’s infrastructure.
It downloads an archive named adobe_update.zip from a private GitHub repository using embedded authentication tokens, extracting the GITSHELLPAD backdoor executable (edgehost.exe) onto the victim’s machine.
This multi-stage architecture allows threat actors to maintain flexibility in payload delivery and reduce detection risks.
GITSHELLPAD is a sophisticated backdoor that leverages private GitHub repositories as its command-and-control channel an unconventional approach that evades traditional network-based detection mechanisms.
The backdoor registers victims by creating GitHub directories with the format “SYSTEM-[hostname]” and commits victim information in Base64-encoded format.
The malware polls GitHub every 15 seconds for commands stored in command.txt files within threat actor-controlled repositories.
It supports six command categories: directory navigation, background command execution, file upload/download, and filesystem/process cleanup.
During the investigation, researchers discovered four private GitHub repositories containing over 200 post-compromise commands, revealing extensive reconnaissance activities including user enumeration, network mapping, system information gathering, and staged tool deployment.
GOSHELL: Selective Beacon Deployment
GOSHELL serves as a multi-stage shellcode loader designed to deploy Cobalt Strike Beacon on specific target systems.
The malware artificially inflates to approximately one gigabyte by embedding junk byte sequences, likely to evade antivirus detection mechanisms.
Critically, GOSHELL incorporates a hardcoded hostname whitelist the malware only executes if the compromised system’s hostname matches predefined targets, ensuring selective compromise of high-value objectives.
The payload undergoes three decoding stages before executing a stageless Cobalt Strike Beacon configured for HTTPS communication on port 443.
ThreatLabz’s assessment that this activity may originate from a new APT group or parallel Pakistan-linked threat actor suggests fragmentation or expansion within Pakistan’s cyber threat landscape.
The Cobalt Strike configuration was derived from publicly available profiles, indicating that the attackers leveraged open-source frameworks while implementing custom obfuscation techniques.
The use of private GitHub repositories for C2 communication represents a sophisticated evasion technique that exploits legitimate cloud services to mask malicious traffic.
The targeting specificity geofencing, hostname validation, and selective beacon deployment indicates thorough reconnaissance and a patient, methodical approach to government system compromise.
The technical sophistication, targeting focus, and operational security measures employed suggest these campaigns target sensitive government functions and classified information access.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
