Covert Data Heist: APT36 Exploits ZIP Vulnerabilities in BOSS Linux Systems

CYFIRMA identifies a sophisticated APT36 campaign targeting India’s defense sector by leveraging phishing ZIP attachments that drop a .desktop launcher which silently installs a Go-based ELF backdoor (BOSS.elf) on BOSS Linux systems; the malware performs system reconnaissance, captures screenshots, maintains persistent TCP C2 (notably 101.99.92.182:12520), and facilitates covert data exfiltration, with multiple IOCs and mitigation recommendations provided.