APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

Socprime

APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

First seen 6 Jan 2026, 02:27 UTC • •52.3

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

APT36, also known as Transparent Tribe, conducted a spear-phishing campaign targeting Indian government, strategic, and academic organizations. The campaign involved delivering malicious LNK files disguised as PDFs, which exploited mshta.exe to execute a remote HTA loader and deploy a fileless RAT. The malware adapts its persistence methods based on the victim's antivirus software.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (2)

Threat Graph

14 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT36
Transparent Tribe

Technique (7)

Malware
Phishing
T1059.001 - PowerShell
T1132 - Data Encoding
T1140 - Deobfuscate/Decode Files Or Information
T1218.005 - Mshta
T1566 - Spearphishing Attachment

Campaign (1)

APT36 Campaign

Malware (1)

Ki2mtmkl.dll

Affected Platform (1)

Windows

Tool (2)

Mshta
PowerShell

Relationships

APT36 uses Ki2mtmkl.dll
Transparent Tribe uses Ki2mtmkl.dll
APT36 uses Mshta
APT36 uses PowerShell
Transparent Tribe uses Mshta
Transparent Tribe uses PowerShell
APT36 uses Malware
APT36 uses Phishing
APT36 uses T1059.001 - PowerShell
APT36 uses T1132 - Data Encoding
APT36 uses T1140 - Deobfuscate/Decode Files Or Information
Transparent Tribe uses Malware
Transparent Tribe uses Phishing
Transparent Tribe uses T1059.001 - PowerShell
Transparent Tribe uses T1132 - Data Encoding
Transparent Tribe uses T1140 - Deobfuscate/Decode Files Or Information
APT36 Campaign attributed to APT36
APT36 Campaign attributed to Transparent Tribe
APT36 Campaign uses Ki2mtmkl.dll
APT36 related to T1218.005 - Mshta
APT36 related to T1566 - Spearphishing Attachment
APT36 related to Windows

Following this threat?

Track APT36 and Ki2mtmkl.dll in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

APT36 Launches Operation RapidRust with New Rust Malware Tools In August 2026, the Pakistan-nexus threat actor APT36 initiated Operation RapidRust, targeting government and defense organizations in India and Afghanistan. The campaign introduced several new Rust-based malware tools, including the RUSTYSHADE backdoor and RUSTYMOVE propagation tool. APT36 also deployed file-stealing…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…