Socprime

APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

First seen 6 Jan 2026, 02:27 UTC • Scworld

•52.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

APT36, also known as Transparent Tribe, conducted a spear-phishing campaign targeting Indian government, strategic, and academic organizations. The campaign involved delivering malicious LNK files disguised as PDFs, which exploited mshta.exe to execute a remote HTA loader and deploy a fileless RAT. The malware adapts its persistence methods based on the victim's antivirus software.

How this analysis works

Attack Flow

15 entities, 23 inferred relationships (STIX 2.1).

Threat Actor (2)

Apt36
Transparent Tribe

Technique (7)

Malware
Phishing
T1059.001 - PowerShell
T1132 - Data Encoding
T1140 - Deobfuscate/Decode Files Or Information
T1218.005 - Mshta
T1566 - Spearphishing Attachment

Campaign (1)

Apt36 Campaign

Indicator (1)

innlive.in

Malware (1)

Ki2mtmkl.dll

Affected Platform (1)

Windows

Tool (2)

Mshta
PowerShell

Relationships

Apt36 uses Ki2mtmkl.dll
Transparent Tribe uses Ki2mtmkl.dll
Apt36 uses Mshta
Apt36 uses PowerShell
Transparent Tribe uses Mshta
Transparent Tribe uses PowerShell
Apt36 uses Malware
Apt36 uses Phishing
Apt36 uses T1059.001 - PowerShell
Apt36 uses T1132 - Data Encoding
Apt36 uses T1140 - Deobfuscate/Decode Files Or Information
Transparent Tribe uses Malware
Transparent Tribe uses Phishing
Transparent Tribe uses T1059.001 - PowerShell
Transparent Tribe uses T1132 - Data Encoding
Transparent Tribe uses T1140 - Deobfuscate/Decode Files Or Information
Ki2mtmkl.dll communicates with innlive.in
Apt36 Campaign attributed to Apt36
Apt36 Campaign attributed to Transparent Tribe
Apt36 Campaign uses Ki2mtmkl.dll
Apt36 related to T1218.005 - Mshta
Apt36 related to T1566 - Spearphishing Attachment
Apt36 related to Windows

Continue Reading

Coordinated Cyberattack Disrupts Water Utilities in Minnesota China-aligned APT Groups Target Global Maritime and Tech Sectors Amid Geopolitical Tensions PATCHCORD Malware Targets Afghan Telecom and South Asian Infrastructure State-Linked Cyber Threats Intensify Amid AI Advancements SideCopy Targets Afghanistan Finance Ministry with XenoRAT Campaign Bitdefender Alerts on APT36's New AI 'Vibeware' Targeting India

APT36 Campaign Uses LNK Files for Cyberespionage Against Indian Targets

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading