Cyber: Experts Detect Pakistan-linked Cyber Campaigns Aimed At Indian...

Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft.

The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025.

"While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) group, APT36, we assess with medium confidence that the activity identified during this analysis might originate from a new subgroup or another Pakistan-linked group operating in parallel," researchers Sudeep Singh and Yin Hong Chang said.

Sheet Attack gets its name from the use of legitimate services like Google Sheets, Firebase, and email for command-and-control (C2). On the other hand, Gopher Strike is assessed to have leveraged phishing emails as a starting point to deliver PDF documents containing a blurred image that's superimposed by a seemingly harmless pop-up instructing the recipient to download an update for Adobe Acrobat Reader DC.

The main purpose of the image is to give the users an impression that it's necessary to install the update in order to access the document's contents. Clicking the "Download and Install" button in the fake update dialog triggers the download of an ISO image file only when the requests originate from IP addresses located in India and the User-Agent string corresponds to Windows.

"These server-side checks prevent automated URL analysis tools from fetching the ISO file, ensuring that the malicious file is only delivered to intended targets," Zscaler said.

The malicious payload embedded within the ISO image is a Golang-based downloader dubbed GOGITTER that's responsible for creating a Visual Basic Script (VBScript) file if it does not already exist in the following locations: "C:\Users\Public\Downloads," "C:\Users\Public\Pictures," and "%APPDATA%." The script is designed to fetch VBScript commands every 30 seconds from two pre-configured C2 servers.

GOGITTER also sets up persistence using a scheduled task that's configured to run the aforementioned VBScript file every 50 minutes. In addition, it ascertains the presence of another file named "adobe_update.zip" in the same three folders. If the ZIP file is not present, it pulls the archive from a private GitHub repository ("github[.]com/jaishankai/sockv6"). The GitHub account was created on June 7, 2025.

Once the download is successful, the attack chain sends an HTTP GET request

Source: The Hacker News