Pakistan-linked Hackers Deploy Python, Golang, and Rust Malware on Indian Targets

Transparent Tribe (APT36) conducted spear-phishing campaigns from late 2023 through April 2024 against Indian government, defense, and aerospace targets, deploying cross-platform espionage tooling (Python/Golang/Rust) such as GLOBSHELL and PYSHELLFOX, abusing services like Discord, Google Drive, Slack, and Telegram for C2 and distribution, and using ISO/ZIP lures and identified infrastructure (e.g., apsdelhicantt.in) to exfiltrate sensitive files.