NewKerala.com

Pakistan-Linked Cyber Attacks Target Indian Government in Sophisticated Campaigns

Cybersecurity researchers have identified two new Pakistan-linked cyber campaigns, named Gopher Strike and Sheet Attack, targeting Indian government entities. These operations use sophisticated methods like phishing emails with malicious PDFs and legitimate services like Google Sheets for command-and-control. The malware is designed to only deliver payloads to systems with Indian IP addresses, enabling remote control, data theft, and persistent surveillance. This activity is assessed to potentially originate from a new subgroup operating alongside the known APT36 threat actor, which has a long history of targeting Indian and Afghan institutions.

Key Points: Pakistan Cyber Attacks Target Indian Government Entities

  • New Gopher Strike & Sheet Attack campaigns identified
  • Use of Google Sheets & phishing for malware delivery
  • Targets limited to Indian IP addresses
  • Malware can remotely control systems & steal data
  • Linked to persistent APT36 threat actor
3 min read

Experts unmask more sinister Pakistan-linked cyber campaigns against India

New reports reveal Gopher Strike and Sheet Attack campaigns by Pakistan-linked threat actors targeting Indian government with sophisticated malware and phishing.

"We assess with medium confidence that the activity... might originate from a new subgroup or another Pakistan-linked group - Researchers Sudeep Singh & Yin Hong Chang"

New York/New Delhi, Jan 28 The Indian government entities have been targetted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft, a report has revealed.

The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025, leading cybersecurity news platform 'The Hacker News' reported.

"While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) group, APT36, we assess with medium confidence that the activity identified during this analysis might originate from a new subgroup or another Pakistan-linked group operating in parallel," researchers Sudeep Singh and Yin Hong Chang were quoted as saying by The Hacker News.

Sheet Attack, the report mentioned, gets its name from the use of legitimate services like Google Sheets, Firebase, and email for command-and-control (C2).

"On the other hand, Gopher Strike is assessed to have leveraged phishing emails as a starting point to deliver PDF documents containing a blurred image that's superimposed by a seemingly harmless pop-up instructing the recipient to download an update for Adobe Acrobat Reader DC," it added.

According to The Hacker News, users are urged to install the "necessary update" in order to access the document's contents. Clicking the "Download and Install" button in the fake update dialog triggers the download of an ISO image file only when the requests originate from IP addresses located in India and the User-Agent string corresponds to Windows.

"These server-side checks prevent automated URL analysis tools from fetching the ISO file, ensuring that the malicious file is only delivered to intended targets," Zscaler said.

Earlier this month, another report had revealed that Pakistan-linked hackers have launched a new spying campaign targetting the Indian government and universities, including strategic institutions, to procure sensitive information by making the system defunct with the use of spyware and malware.

The sinister campaign was flagged by researchers at the cybersecurity firm Cyfirma, which claims to have unearthed the modus operandi of these cyber spies.

"The operation begins with spear-phishing emails carrying a ZIP archive containing a malicious file disguised as a PDF. Once opened, the file delivers two malware components, dubbed ReadOnly and WriteOnly," The Record reported, citing instances of security breaches.

The malware gets embedded on victims' systems, adjusting its behaviour based on which antivirus software is installed.

According to Cyfirma, this can remotely control infected machines, compromise classified data and carry out persistent surveillance - including taking screenshots, monitoring clipboard activity and enabling remote desktop access.

According to the report, this could also be used to steal overwritten copied data, allowing attackers to hijack cryptocurrency transactions.

The secret surveillance has been attributed to APT36, also called Transparent Tribe, a long-running threat actor accused of spying on government bodies, military-linked organisations and universities.

While researchers have previously described Transparent Tribe as less technically advanced than some rival espionage groups, they have also noted its persistence and ability to adapt tactics over time.

According to the report, APT36 has been active since 2013, and linked to cyber-espionage campaigns targeting government and military organisations in India as well as Afghanistan, as well as institutions in roughly 30 countries.

- IANS

Share this article:

Reader Comments

S
Sarah B
The technical sophistication here is alarming—using Google Sheets for command and control is clever and hard to detect. It shows these groups are evolving. India's CERT-In and other agencies have their work cut out for them.
P
Priya S
As someone who works in IT, the detail about the ISO only downloading for Indian IPs on Windows is chilling. They are very targeted. We all need to be more careful with emails and updates, especially from unknown sources. #CyberAwareness
R
Rahul R
While the threat is real, I sometimes feel our media and agencies are too quick to blame "Pakistan-linked" groups for every hack. We should focus on fixing our own vulnerabilities first—our government websites and digital infrastructure are often outdated.
A
Anjali F
Targeting universities and strategic institutions is a serious national security issue. We are producing brilliant minds in IITs and other colleges; we need to channel that talent into building impenetrable digital shields for our country.
K
Karthik V
Active since 2013 and still going strong? This shows a failure of our cyber deterrence. We need a clear and public policy on how we respond to such persistent attacks, not just reports and alerts.

We welcome thoughtful discussions from our readers. Please keep comments respectful and on-topic.

Leave a Comment

Minimum 50 characters 0/50