APT36 Python Based ELF Malware Targeting Indian Government Entities

MITRE Techniques

• [T1566 ] Phishing – Used spear-phishing emails to deliver weaponized Linux shortcut files (‘The intrusion begins with spear-phishing emails designed to lure recipients into opening weaponized Linux shortcut files.’)
• [T1059 ] Command and Scripting Interpreter – The .desktop Exec field runs shell commands that decode Base64 and execute the embedded script (‘Exec field secretly runs a shell command that echoes a Base64-encoded string, decodes it, and executes the resulting script.’)
• [T1064 ] Scripting – Shell scripts downloaded and executed additional payloads and established persistence (‘the script downloads two additional payloads… and executes the files ./swcbc and ./swcbc.sh in the background.’)
• [T1129 ] Shared Modules – Malware contains cross-platform functions and shared command handlers to enable identical C2-driven behavior on Linux and Windows (‘exposes cross-platform functions, shared command handlers, and identical C2-driven behavior for both operating systems.’)
• [T1543 ] Create or Modify System Process – The bash script creates a user-level systemd service file to run the ELF and ensure automatic restarts and startup execution (‘leverages systemd’s user-level service functionality to establish persistence… creating a corresponding systemd service file within the user’s configuration directory.’)
• [T1027 ] Obfuscated Files or Information – Malicious logic is hidden via Base64 encoding and PyInstaller packaging to reduce detection and analysis (‘hiding the malicious logic inside encoded data’ and ‘PyInstaller packaging… to obfuscate its contents’).
• [T1036 ] Masquerading – The .desktop file is styled to appear as a normal document shortcut to deceive users (‘The .desktop entry is designed to appear as a normal document shortcut’).
• [T1070 ] Indicator Removal on Host – The malware includes a clean/uninstall routine that removes installation artifacts and autostart entries (‘The clean function acts as a self-destruct mechanism, removing all traces of the malware from the infected system.’)
• [T1222 ] File and Directory Permissions Modification – The installer applies execution permissions to downloaded files using chmod to enable execution (‘applies execution permissions to both files using the chmod +x command.’)
• [T1564 ] Hide Artifacts – .desktop metadata and settings (Terminal=false, Icon) are used to conceal background execution (‘Terminal=false hides all command execution, Type=Application makes the system run the embedded commands, and Icon=x-office-document gives it a familiar document icon’).
• [T1082 ] System Information Discovery – The implant collects OS platform and release information as part of initial profiling (‘Collects OS platform and release information’).
• [T1083 ] File and Directory Discovery – The malware immediately performs file system enumeration to identify targets for exfiltration (‘Immediately performs file system enumeration’).
• [T1046 ] Network Service Discovery – The malware establishes network communication and baseline state to support C2 interactions (‘Establishes baseline system state’).
• [T1518 ] Software Discovery – The implant gathers platform and environment details to adapt execution and persistence mechanisms (‘Collects OS platform and release information’ and identifies BOSS targets).
• [T1071 ] Application Layer Protocol – C2 communications use HTTP POST requests to send system data and receive commands (‘It uses HTTP POST requests to connect to its command and control (C2) center’).
• [T1095 ] Non-Application Layer Protocol – The campaign uses alternate network channels for C2 alongside application-layer traffic (‘the malware sets up a two-way communication channel with the attacker’s server’).
• [T1105 ] Ingress Tool Transfer – Secondary payloads are retrieved from attacker-controlled servers via HTTP GET and script-driven downloads (‘the script downloads two additional payloads from the attacker-controlled server 185[.]235[.]137[.]90[:]32587’).
• [T1571 ] Non-Standard Port – Payload hosting and transfer used a non-standard port (32587) in the attacker-controlled URL (‘retrieved from http://185[.]235[.]137[.]90[:]32587/uploads/…’).
• [T1573 ] Encrypted Channel – C2-driven behavior and channel management are emphasized for secure operator communications (‘exposes cross-platform functions, shared command handlers, and identical C2-driven behavior for both operating systems.’)