“Gopher Strike”: New Pakistan-Linked Cyber Campaigns Target Indian Government

Zscaler ThreatLabz reported two Pakistan-linked cyberespionage campaigns (Gopher Strike and Sheet Attack) observed from September 2025 targeting Indian government entities. Gopher Strike uses Golang-based tools—GOGITTER (downloader), GOSHELL (shellcode loader for Cobalt Strike Beacon), and GITSHELLPAD (backdoor abusing private GitHub repos for C2)—delivered via malicious PDFs and ISO payloads; Sheet Attack reportedly experiments with generative AI in malware. Researchers see similarities to APT36 but suggest a possible new subgroup, and advise monitoring PDFs/ISO attachments and traffic to private GitHub repositories.