Pakistan-linked hackers target Indian government, universities: Report

A Pakistan-linked hacker group, APT36 (Transparent Tribe), has launched a cyber espionage campaign targeting Indian government bodies and universities. Malware delivered via spear-phishing emails can steal data, monitor activity, and hijack cryptocurrency transactions, cybersecurity firm Cyfirma reports.

New Delhi: In an age of cutting-edge technology and Artificial Intelligence (AI), several installations, including government portals and academic institutions, are under increased threats of cyber espionage, purportedly driven by the Pakistan-aligned hacker group, said a news report.

According to the report, Pakistan-linked hackers have launched a new spying campaign targeting the Indian government and universities, including strategic institutions, to procure sensitive information by making the system defunct with the use of spyware and malware.

---

The sinister campaign has been flagged by researchers at the cybersecurity firm Cyfirma, which claims to have unearthed the modus operandi of these cyber spies.

“The operation begins with spear-phishing emails carrying a ZIP archive containing a malicious file disguised as a PDF. Once opened, the file delivers two malware components, dubbed ReadOnly and WriteOnly,” The Record reported, citing instances of security breaches.

The malware gets embedded on victims’ systems, adjusting its behavior based on which antivirus software is installed.

According to Cyfirma, this can remotely control infected machines, compromise classified data and carry out persistent surveillance – including taking screenshots, monitoring clipboard activity and enabling remote desktop access.

According to the report, this could also be used to steal overwritten copied data, allowing attackers to hijack cryptocurrency transactions.

The secret surveillance has been attributed to APT36, also called Transparent Tribe, a long-running threat actor accused of spying on government bodies, military-linked organisations and universities.

While researchers have previously described Transparent Tribe as less technically advanced than some rival espionage groups, they have also noted its persistence and ability to adapt tactics over time.

According to the report, APT36 has been active since 2013, and linked to cyber-espionage campaigns targeting government and military organisations in India as well as Afghanistan, as well as institutions in roughly 30 countries.