Full Report
Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft. The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025. "While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT)
Analysis Summary
# Threat Actor: Undocumented Pakistan-linked Actor
## Attribution & Identity
* **Primary Affiliation:** Threat actor believed to operate in Pakistan.
* **Relationship to Known Groups:** Shares similarities with the Pakistan-linked Advanced Persistent Threat (APT) group APT36, but researchers assess with medium confidence that this may be a new subgroup or another group operating in parallel.
* **Detection:** Identified by Zscaler ThreatLabz in September 2025.
## Activity Summary
The actor was observed conducting two separate cyber espionage campaigns targeting Indian government entities:
1. **Gopher Strike:** Began with phishing emails designed to deliver weaponized PDF documents.
2. **Sheet Attack:** Utilized legitimate cloud services like Google Sheets and Firebase for Command-and-Control (C2) infrastructure.
## Tactics, Techniques & Procedures
The actor employs previously undocumented tradecraft across both campaigns:
* **Initial Access (Gopher Strike):** Phishing emails delivered PDF documents containing a blurred image overlaid with a fake Adobe Acrobat Reader DC update prompt.
* **Geo-Fencing/Anti-Analysis:** The download of the malicious ISO file was conditional, triggered only if the request originated from an **Indian IP address** AND used a **Windows User-Agent string**. This prevents automated analysis tools from retrieving the payload.
* **Payload Delivery:** Malicious binary delivered via ISO image fetched from the phishing lure.
* **Persistence Mechanism:** Installation of a VBScript file in public user directories (`C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, `%APPDATA%`) set to execute commands every 30 seconds via a scheduled task running every 50 minutes.
* **Secondary Payload Retrieval:** The initial downloader (GOGITTER) checked for `adobe_update.zip` in public folders, pulling it from a private GitHub repository if absent.
* **C2 via GitHub (GITSHELLPAD):** A Golang-based backdoor polled a private GitHub repository (`github[.]com/jaishankai/sockv6`) every 15 seconds by issuing a GET request to read instructions from a file named `command.txt`.
* **Data Exfiltration:** Command execution results (`result.txt`) were uploaded to GitHub via an HTTP PUT request and subsequently deleted from the repository.
* **Post-Exploitation:** Downloading and executing RAR archives containing utilities for system information gathering, leading up to the deployment of GOSHELL (a Golang loader) to deploy Cobalt Strike Beacon.
* **Defense Evasion:** Tools are reportedly wiped from the machine after use. The GOSHELL malware file size was artificially inflated to approximately 1 gigabyte.
## Targeting
* **Sectors:** Government entities.
* **Geography:** Targeting entities located in **India**. The actor group is assessed to operate from **Pakistan**.
* **Victims:** Indian government entities.
## Tools & Infrastructure
* **Malware Families:**
* **GOGITTER:** Golang-based downloader.
* **GITSHELLPAD:** Lightweight Golang-based backdoor utilizing GitHub for C2.
* **GOSHELL:** Bespoke Golang-based loader used to deploy Cobalt Strike Beacon.
* **Infrastructure:**
* **C2 (Sheet Attack):** Google Sheets, Firebase, and email.
* **C2 (Gopher Strike Initial):** Two pre-configured servers for fetching VBScript commands.
* **C2 (GITSHELLPAD):** Private GitHub repositories, specifically `github[.]com/jaishankai/sockv6` (GitHub account created June 7, 2025).
* **Indicator of Compromise (IoC):** The domain `adobe-acrobat[.]in` was contacted after a successful download to signal infection status.
## Implications
The actor demonstrates sophisticated tradecraft aimed at bypassing automated defenses through geo-specific file delivery and leveraging popular developer platforms (GitHub) as discreet C2 channels, indicating a high operational security focus for espionage against Indian government rivals. The switch to documented APT-adjacent capabilities alongside novel techniques suggests either a highly adaptive new group or a segment of an existing group developing new TTPs.
## Mitigations
* **Content Inspection:** Implement strict filtering on incoming PDF attachments, especially those suggesting required software updates (e.g., Adobe Reader).
* **Network Monitoring:** Monitor for outbound connections to GitHub repositories (especially reads/writes of non-standard files) originating from unusual application processes.
* **Endpoint Detection & Response (EDR):** Enhance detection for scheduled task creation, VBScript execution from public folders, and the appearance of Golang binaries in user profiles.
* **Anti-Analysis Safeguards:** Security tools must be configured to fully emulate user environments, including requesting specific geographic IPs and User-Agent strings, to ensure full payload detonation and analysis.