Comprehensive Threat Exposure Management Platform
A Pakistan-linked threat actor launched two parallel cyber-espionage campaigns, Gopher Strike and Sheet Attack, targeting Indian government entities beginning in September 2025. These campaigns blend social engineering with cloud-native command-and-control infrastructure to remain hidden in plain sight. The operations begin with weaponized PDFs masquerading as official government documents and fake Adobe updates, selectively delivering payloads only to Indian Windows systems to evade automated analysis. Gopher Strike abuses private GitHub repositories to deploy Golang-based loaders and backdoors that culminate in hands-on intrusion and Cobalt Strike activity, while Sheet Attack leverages trusted services such as Google Sheets, Firebase, and Microsoft Graph for command execution, data theft, and exfiltration. The combination of novel tooling, cloud service abuse, and interactive post-compromise behavior, alongside signs of AI-assisted development, signals a notable evolution beyond classic APT36 tradecraft, suggesting a parallel Pakistan-aligned espionage operation operating with greater precision and stealth against Indian government targets.
In September 2025, two parallel cyber-espionage campaigns, tracked as Gopher Strike and Sheet Attack, were observed targeting Indian government entities. Both operations are attributed to a Pakistan-linked threat actor and show partial overlaps with APT36, while introducing new tools and tactics. The attacks begin with spear-phishing emails carrying malicious PDF files that mimic official government documents, overlaid with fake Adobe update prompts. Payload delivery is tightly controlled through server-side checks that validate Indian IP ranges and Windows user agents, effectively filtering out sandboxes and automated scanners targeting Indian government infrastructure.
Gopher Strike relies heavily on GitHub for command-and-control operations. Victims are lured into downloading an ISO file that drops GOGITTER, a Golang-based downloader that establishes persistence via a VBScript and a scheduled task disguised as a Microsoft Edge update. GOGITTER pulls the GITSHELLPAD backdoor from private GitHub repositories, using embedded tokens and GitHub’s REST API for two-way C2 communication. In high-value intrusions against Indian government targets, the actor escalates to GOSHELL, an unusually large Golang shellcode loader designed to evade detection, which ultimately deploys a stageless Cobalt Strike Beacon using a jQuery-style Malleable C2 profile.
The Sheet Attack campaign takes a different route by abusing trusted cloud platforms against Indian government entities. Early variants deploy SHEETCREEP, a C# backdoor that uses Google Sheets as its C2 channel, encrypting traffic with TripleDES and executing commands through hidden command-line processes. Newer iterations shift to malicious LNK files delivering FIREPOWER, a PowerShell backdoor that communicates via Google Firebase. Select targets also receive MAILCREEP, a Golang backdoor abusing Microsoft Graph API within an attacker-controlled Azure tenant, alongside a document-stealing PowerShell script that exfiltrates sensitive files to private GitHub repositories.
Across both campaigns targeting Indian government entities, the operator demonstrates strong operational security and active hands-on-keyboard activity, including observable command-line mistakes during post-compromise actions. Malware analysis also points to the likely use of generative AI in development, reflected in verbose Unicode comments and emoji-laden error handling. While victim profiles, infrastructure traits, and some tooling align with APT36, the consistent use of novel backdoors, cloud-native C2 channels, and refined evasion techniques suggests this activity may represent a distinct subgroup, or a parallel Pakistan-linked operation running alongside traditional APT36 campaigns.
Implement immediate blocking of all identified C2 domains including adobe-acrobat.in, adobereader-upgrade.in, adobecloud.site, govt-filesharing.site, hciaccounts.in, hcisupport.in, hcidelhi.in, hcidoc.in, and coadelhi.in at network perimeter and DNS levels to prevent communication with attacker infrastructure.
Implement monitoring and alerting for unusual GitHub API traffic patterns, particularly authentication token usage and repository interactions from endpoints that typically do not require such access, as this is a key indicator of Gopher Strike campaign activity.
Apply strict egress filtering for Google Sheets API, Firebase Realtime Database, and Microsoft Graph API connections from sensitive government network segments, permitting only authorized business applications to prevent Sheet Attack campaign communications.
Deploy application control policies preventing execution of unsigned Golang binaries and PowerShell scripts from user-writable directories to block malware execution from both campaigns.
Segment government networks to limit lateral movement capabilities if initial compromise occurs, particularly isolating systems with access to sensitive documents that are primary targets of these espionage campaigns.
Audit organizational policies regarding GitHub, Google, Firebase, and Microsoft cloud service usage to identify legitimate baseline activity and detect anomalous access patterns associated with both Gopher Strike and Sheet Attack campaigns.
Resource Development
Initial Access
Execution
Persistence
Defense Evasion
Discovery
Collection
Command and Control
Exfiltration
Malware Hashes (MD5, SHA1, SHA256): Multiple hashes provided for GOGITTER, GITSHELLPAD, GOSHELL, SHEETCREEP, FIREPOWER, and MAILCREEP malware samples.
Malicious Domains:
C2 Infrastructure:
IP Address:
Get through updates and upcoming events, and more directly in your inbox