Pakistan-linked Cyber Campaigns Target Indian Government Amid Operation Sindoor

Thehindubusinessline

Pakistan-linked Cyber Campaigns Target Indian Government Amid Operation Sindoor

First seen 28 Jan 2026, 15:08 UTC • •41.4

Article Content

1 / 6

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Indian government entities were targeted in two cyber campaigns, Gopher Strike and Sheet Attack, linked to a threat actor in Pakistan. These campaigns utilized previously undocumented tradecraft and were identified by Zscaler ThreatLabz in September 2025. Concurrently, during Operation Sindoor in May 2025, Indian cyber networks experienced a surge in phishing and malware attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 225d ago How this analysis works

More articles in this cluster (5)

Threat Graph

11 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT36
Transparent Tribe

Technique (2)

Malware
Phishing

Campaign (2)

Gopher Strike
Sheet Attack

Malware (2)

ReadOnly
WriteOnly

Affected Platform (1)

Firebase

Tool (2)

Adobe Acrobat Reader DC
Google Sheets

Relationships

APT36 uses ReadOnly
APT36 uses WriteOnly
Transparent Tribe uses ReadOnly
Transparent Tribe uses WriteOnly
APT36 uses Adobe Acrobat Reader DC
APT36 uses Google Sheets
Transparent Tribe uses Adobe Acrobat Reader DC
Transparent Tribe uses Google Sheets
APT36 uses Malware
APT36 uses Phishing
Transparent Tribe uses Malware
Transparent Tribe uses Phishing
Gopher Strike attributed to APT36
Gopher Strike attributed to Transparent Tribe
Sheet Attack attributed to APT36
Sheet Attack attributed to Transparent Tribe
Gopher Strike uses ReadOnly
Gopher Strike uses WriteOnly
Sheet Attack uses ReadOnly
Sheet Attack uses WriteOnly
APT36 related to Firebase

Following this threat?

Track APT36 and ReadOnly in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Critical RCE Vulnerabilities in Ivanti EPMM Two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1340, affecting Ivanti Endpoint Manager Mobile (EPMM) have been confirmed to allow unauthenticated remote code execution (RCE) through a Bash Arithmetic Expansion mechanism. The vulnerabilities were published on January 29, 2026, with a CVSS score of 9.8…