The state-sponsored hacking group Transparent Tribe (also designated APT36) has launched a sophisticated attack campaign against Indian governmental, academic, and strategic organizations. This Pakistani-origin threat actor, active since 2013, continues to refine its methods for deploying remote access trojans that establish persistent control over compromised systems.

PDF-Based Deception Tactics

According to CYFIRMA’s technical analysis, the campaign demonstrates advanced social engineering through PDF-centric deception. Attackers distribute weaponized Windows shortcut files disguised as legitimate PDF documents, with the malicious LNK files containing embedded PDF content to deflect suspicion during initial inspection.

The attack unfolds through spear-phishing emails containing ZIP archives. When victims open what appears to be a PDF file, the LNK shortcut instead executes a remote HTML Application script via mshta.exe. This script decrypts and loads the RAT payload directly into memory while simultaneously downloading and displaying a genuine PDF document as a decoy, maintaining the illusion of normal file behavior.

Technical Execution Chain

The HTA script establishes decoding logic and employs ActiveX objects, particularly WScript.Shell, to interact with the Windows environment. This approach enables environment profiling and runtime manipulation, ensuring system compatibility and enhancing execution reliability such techniques commonly associated with mshta.exe abuse.

Adaptive Persistence Mechanisms

The malware demonstrates sophisticated environmental awareness by adapting its persistence strategy based on detected antivirus solutions. When Kaspersky is present, it creates a working directory under C:\Users\Public\core, writes an obfuscated HTA payload, and establishes persistence through a LNK file in the Windows Startup folder. Quick Heal detection triggers a different approach using batch files and malicious shortcuts. For Avast, AVG, or Avira installations, the payload copies directly into the Startup directory. Unrecognized antivirus configurations trigger a fallback method combining batch file execution with registry-based persistence.

RAT Capabilities

The deployed DLL (iinneldc.dll) functions as a comprehensive remote access trojan supporting remote system control, file management, data exfiltration, screenshot capture, clipboard manipulation, and process control.

Secondary Campaign Vector

Transparent Tribe has simultaneously operated another campaign using a malicious shortcut masquerading as a government advisory PDF (NCERT-Whatsapp-Advisory.pdf.lnk). This delivers a .NET-based loader that retrieves an MSI installer from a remote server, which then extracts and displays a decoy PDF while deploying malicious DLLs to C:\ProgramData\PcDirvs. The campaign establishes persistence through Visual Basic Script registry modifications ensuring execution after system startup.

Notably, the decoy PDF represents a legitimate 2024 advisory from Pakistan’s National Cyber Emergency Response Team regarding fraudulent WhatsApp campaigns—an ironic choice that may increase victim trust.

Command and Control Infrastructure

The deployed wininet.dll connects to command-and-control infrastructure at dns.wmiprovider[.]com, registered in mid-April 2025. While currently inactive, registry-based persistence mechanisms allow the threat to reactivate at any time. The DLL implements HTTP GET-based endpoints with reversed character storage to evade static string detection, supporting registration, heartbeat beacons, arbitrary command execution, and anti-VM behavior adjustments.

The malware also conducts reconnaissance by querying installed antivirus products, enabling comprehensive system profiling and sensitive information gathering.

Addressing the Embedded Malware Challenge

Serving AI datasets with for cybersecurity appsThe sophistication of attacks leveraging embedded malicious code in PDF and other document formats has driven the development of advanced protective solutions. CyberQuay, Inc. offers FileDNAtm, a specialized software platform designed to neutralize threats concealed within PDF and numerous other file formats. Rather than relying solely on signature-based detection that can be evaded through obfuscation, FileDNAtm employs file reconstruction technology that disassembles incoming files, analyses and removes potentially malicious embedded content, scripts, and macros, and rebuilds clean versions containing only the legitimate visible content. This reconstruction approach effectively eliminates weaponized embeddings, malicious shortcuts, hidden executables, and obfuscated payloads while preserving the usability and formatting of the original document, providing organizations with a proactive defense against sophisticated file-based attack vectors like those employed by APT36.

References