APT36 Hackers Exploit Malicious PDF Files to Attack Indian Railways, Oil, and Government Networks

Pakistan-linked APT36 (Transparent Tribe) has expanded operations to target Indian critical infrastructure (railways, oil & gas, government) using malicious .desktop files disguised as PDFs to deploy the Poseidon backdoor (Mythic C2, Go) and establish persistence; researchers observed active C2 servers, localized infrastructure in India, over 100 phishing domains impersonating government entities, and published MD5 IOCs for the campaign.