Pakistani APT36 cyber spies are using Linux .desktop files to load malware, launching new attacks against Indian government and defense entities.Reports from CYFIRMA and CloudSEK document this activity, which aims to steal data and maintain persistent espionage access. APT36 has previously used .desktop files to load malware in targeted espionage operations in South Asia.These attacks were first discovered on August 1, 2025, and according to the latest evidence, they are still ongoing.Abuse of Desktop FilesAlthough the attacks described in both reports use different infrastructures and samples (based on hashes), the techniques, tactics, and procedures (TTP), attack chain, and apparent targets are the same.Victims receive ZIP files via phishing emails, containing malicious .desktop files disguised as PDF documents and named accordingly.Linux .desktop files are text-based application launchers that contain configuration options dictating how the desktop environment displays and runs applications.When users open the .desktop file thinking it is a PDF, it triggers a bash command hidden in the “Exec=” field to create a temporary filename in “/tmp/” and write a hex-encoded payload fetched from the attacker’s server or Google Drive.It then runs “chmod +x” to make it executable and starts it in the background.To reduce suspicion from the victims, the script also launches Firefox to display a benign bait PDF file hosted on Google Drive.
In addition to manipulating the “Exec=” field to run a series of shell commands, the attackers also added fields like “Terminal=false” to hide the terminal window from the user, and “X-GNOME-Autostart-enabled=true” to run the file at every login.
Typically, .desktop files on Linux are plain text shortcut files that define the icon, name, and command to execute when the user clicks on them.However, in the APT36 attacks, the attackers abuse this launcher mechanism, effectively turning it into a malware delivery and persistence establishment system, similar to how “LNK” shortcuts are abused on Windows.Since .desktop files on Linux are usually text rather than binary files, and their abuse has not been widely documented, security tools on the platform are less likely to monitor them as potential threats.In this case, the payload released by the malformed .desktop file is a Go-based ELF executable capable of espionage functions.Despite packaging and obfuscation making analysis challenging, researchers found that it could be set to remain hidden or attempt to establish its own persistence using cron jobs and systemd services.Communication with the C2 is conducted through a bidirectional WebSocket channel, allowing for data exfiltration and remote command execution.
Both cybersecurity companies believe that this latest activity marks an evolution in APT36’s attack strategies, becoming more evasive and complex.Source: leepingComputer