APT36 Hackers Used Python-Based ELF Malware to Target Indian Government Entities

APT36 (Transparent Tribe) is conducting a targeted campaign against Indian government agencies using spear-phishing archives that drop weaponized .desktop shortcut files which download and run a Python-based ELF remote access Trojan on Linux (BOSS OS). The malware provides remote command execution, screenshot capture, data exfiltration, and persistence via systemd; researchers identified active infrastructure (lionsdenim.xyz, IP 185.235.137.90) and recommend strengthening email security, EDR, and application authorization.