APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

First seen 6 Jan 2026, 02:27 UTC •ScworldSocprime •0% similarity •52.3

Article Content

Browse articles
ThreatCluster

APT36, also known as Transparent Tribe, conducted a spear-phishing campaign targeting Indian government, strategic, and academic organizations. The campaign involved delivering malicious LNK files disguised as PDFs, which exploited mshta.exe to execute a remote HTA loader and deploy a fileless RAT. The malware adapts its persistence methods based on the victim's antivirus software.

ThreatCluster AI

Extracted Entities

1 / 2

Community

Browse all →