Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft.
The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025.
“While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) group, APT36, we assess with medium confidence that the activity identified during this analysis might originate from a new subgroup or another Pakistan-linked group operating in parallel,” researchers Sudeep Singh and Yin Hong Chang said.
Sheet Attack gets its name from the use of legitimate services like Google Sheets, Firebase, and email for command-and-control (C2). On the other hand, Gopher Strike is assessed to have leveraged phishing emails as a starting point to deliver PDF documents containing a blurred image that’s superimposed by a seemingly harmless pop-up instructing the recipient to download an update for Adobe Acrobat Reader DC.
The main purpose of the image is to give the users an impression that it’s necessary to install the update in order to access the document’s contents. Clicking the “Download and Install” button in the fake update dialog triggers the download of an ISO image file only when the requests originate from IP addresses located in India and the User-Agent string corresponds to Windows.
“These server-side checks prevent automated URL analysis tools from fetching the ISO file, ensuring that the malicious file is only delivered to intended targets,” Zscaler said.
The malicious payload embedded within the ISO image is a Golang-based downloader dubbed GOGITTER that’s responsible for creating a Visual Basic Script (VBScript) file if it does not already exist in the following locations: “C:\Users\Public\Downloads,” “C:\Users\Public\Pictures,” and “%APPDATA%.” The script is designed to fetch VBScript commands every 30 seconds from two pre-configured C2 servers.
GOGITTER also sets up persistence using a scheduled task that’s configured to run the aforementioned VBScript file every 50 minutes. In addition, it ascertains the presence of another file named “adobe_update.zip” in the same three folders. If the ZIP file is not present, it pulls the archive from a private GitHub repository (“github[.]com/jaishankai/sockv6”). The GitHub account was created on June 7, 2025.
Once the download is successful, the attack chain sends an HTTP GET request to the domain “adobe-acrobat[.]in” likely to signal the threat actors that the endpoint has been infected. GOGITTER then extracts and executes “edgehost.exe” from the ZIP file. A lightweight Golang-based backdoor, GITSHELLPAD, leverages threat actor-controlled private GitHub repositories for C2.
Specifically, it polls the C2 server every 15 seconds by means of a GET request to access the contents of a file named…
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
