南亚某组织的双平台后门：StealthServer

This report analyzes a cross-platform Golang backdoor family dubbed "StealthServer" (Windows and Linux variants) observed since July/August 2025, detailing loaders (.desktop and Office macro), persistence mechanisms (systemd, cron, registry, startup shortcuts, service), anti-analysis and anti-debug techniques, C2 protocols (HTTP, TCP, WebSocket) and commands (file listing, upload, execute), file-exfiltration (AES-GCM) behavior, multiple C2 domains/IPs and sample hashes, and presents a likely linkage to APT36 based on targeting, delivery patterns, development paths, and domain naming similarities.