APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor

APT36 (Transparent Tribe) is actively targeting Indian government and civilian infrastructure using .desktop file lures to deliver a Go-based Poseidon backdoor built on the Mythic C2 framework and a broad phishing infrastructure; analysts identified two infection variants (single and redundant C2), live Mythic C2 servers (port 7443) and multiple DigitalOcean-hosted C2 IPs, plus over 100 phishing domains (many hosted via AlexHost/AlexHost-linked IPs) impersonating Indian government services, and the report provides hashes, IPs, domain lists and mitigation guidance.