APT36 hackers abuse Linux .desktop files to install malware in new attacks

Pakistani APT36 cyberspies are actively targeting Indian government and defense entities with sophisticated attacks leveraging Linux .desktop files to deploy malware for data exfiltration and persistent espionage. These ongoing campaigns, first observed in August 2025, utilize phishing emails to deliver malicious .desktop files disguised as PDFs, exploiting their text-based nature to bypass conventional security tools and establish covert remote access. This tactic signifies an evolution in APT36's methods, presenting a heightened and evasive threat to organizations operating on Linux platforms.

Analysis

A sophisticated and ongoing cyber-espionage campaign attributed to the Pakistani state-sponsored group APT36 is actively targeting Indian government and defense entities. The operation, first observed on August 1, 2025, leverages a novel and evasive technique involving malicious Linux .desktop files disguised as PDF documents and delivered via phishing. This method abuses the 'Exec=' field within the text-based .desktop file to download and execute a Go-based espionage payload, while also establishing persistence through the 'X-GNOME-Autostart-enabled=true' setting. The attack's evasiveness stems from the fact that security tools are less likely to scrutinize text-based .desktop files compared to binary executables. The attack chain utilizes Google Drive for hosting decoy documents and potentially payloads, highlighting the abuse of legitimate cloud infrastructure. This campaign marks a significant evolution in APT36's tactics, demonstrating increased sophistication and presenting a heightened threat to organizations operating on Linux platforms, a key area within the geopolitical cyber conflict between the two nations.

Key Decisions for Investors

• Investors should evaluate cybersecurity firms with strong offerings in Linux endpoint detection and response (EDR), as this attack highlights a specific, evolving threat vector that creates a commercial opportunity for specialized security vendors.
• For portfolios with exposure to Indian defense or critical infrastructure sectors, this report signals an escalation in geopolitical cyber risk, warranting a review of the operational resilience and cybersecurity posture of these holdings.
• While Alphabet's (GOOGL) platforms are being abused rather than compromised, the use of Google Drive in the attack chain is a reminder of the persistent operational risk for major cloud providers, a factor to monitor in long-term technology investments.