Inside the ZIP Trap: How APT36 Targets BOSS Linux to Exfiltrate Critical Data

CYFIRMA has uncovered a highly sophisticated cyber-espionage campaign orchestrated by APT36, also known as Transparent Tribe, a Pakistan-based threat actor with a notorious history of targeting Indian defense and government sectors.

This latest operation marks a significant shift in tactics, as APT36 adapts its arsenal to infiltrate Linux-based environments, specifically focusing on BOSS Linux, a distribution widely adopted by Indian government agencies.

Sophisticated Cyber-Espionage Campaign

The campaign leverages phishing emails to deliver a malicious ZIP file, “Cyber-Security-Advisory.zip,” which houses a deceptive .desktop shortcut file.

CYFIRMA emphasizes this multi-stage attack is designed to bypass user suspicion and evade traditional security measures, ultimately aiming to exfiltrate sensitive data from critical infrastructure.

By combining social engineering with technical stealth, APT36 demonstrates a worrisome evolution in its operational capabilities, posing a heightened risk to national security.

The attack begins with a seemingly innocuous phishing email, tricking unsuspecting personnel into opening the attached ZIP file.

Inside lies a malicious .desktop file, “Cyber-Security-Advisory.desktop,” masquerading as a legitimate shortcut.

Upon execution, it triggers a dual-action mechanism: it downloads and opens a decoy PowerPoint file (an HTML file with an iframe disguised as a presentation) via LibreOffice Impress to distract the victim, while simultaneously fetching a malicious ELF binary, “BOSS.elf,” saved as “client.elf.”

This binary, written in Go, executes covertly in the background using commands like nohup and redirects output to /dev/null to avoid detection.

Unpacking the Attack

Operating from the writable /tmp directory, the malware establishes persistence, connects to a command-and-control (C2) server at 101.99.92.182:12520, and initiates data collection.

It captures system details such as hostname, CPU, and RAM, scans drives for files, and even takes desktop screenshots using the Go-based “github.com/kbinani/screenshot” library.

This comprehensive reconnaissance enables APT36 to tailor further attacks, while continuous reconnection attempts every 30 seconds ensure persistent access for data exfiltration.

The use of Linux-specific payloads and evasion techniques like logging via main.junkcalc2 underscores the group’s intent to remain undetected within highly secure environments.

This campaign represents a critical escalation in APT36’s targeting of BOSS Linux systems, highlighting the urgent need for robust cybersecurity measures.

Organizations, particularly in the Indian defense sector, must prioritize email security by implementing advanced filtering, sandboxing attachments, and disabling unverified executable content.

User awareness training to recognize phishing tactics and suspicious file types is paramount.

Additionally, system hardening through restricted execution permissions in directories like /tmp, application whitelisting, and endpoint detection tools tailored for Linux threats can mitigate risks.

Monitoring outbound traffic for connections to malicious domains like sorlastore.com and integrating threat intelligence to track APT36’s tactics, techniques, and procedures (TTPs) mapped to the MITRE ATT&CK framework are essential steps.

As nation-state actors continue to refine their strategies, proactive defense, continuous monitoring, and timely updates to security protocols remain the strongest bulwarks against such insidious threats.

Indicators of Compromise (IOCs)

S. No.	Indicator	Remarks
1	608fff2cd4b727799be762b95d497059a202991eb3401a55438071421b9b5e7a	Block
2	ace379265be7f848d512b27d6ca95e43cef46a81dc15d1ad92ec6f494eed42ab	Block
3	e528799a29e9048c1e71b78223311cad2699d035a731d1a6664fc8ddd0642064	Block
4	167b387005d6d2a55ad282273c58d1786a2ee0fa3e7e0cb361d4d61d8618ee5f	Block
5	https://govin.sorlastore[.]com/uploads/Cyber-Security-Advisory.pptx	Block
6	https://govin.sorlastore[.]com/uploads/BOSS.elf	Block
7	sorlastore[.]com	Block
8	http://169.254.169[.]254/latest/meta-data/ami-id	Monitor
9	169.254.169[.]254	Monitor
10	101.99.92[.]182	Monitor
11	modgovin.onthewifi[.]com	Monitor

Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free