Quick Summary
Indian government entities have been targeted in two cyber campaigns, Gopher Strike and Sheet Attack, linked to a Pakistan-based threat actor. Identified by Zscaler ThreatLabz in September 2025, these campaigns use sophisticated techniques, including phishing emails and legitimate services for command-and-control. The attacks aim to deliver malware, including a Golang-based downloader named GOGITTER, which establishes persistence and communicates with threat actor-controlled servers, posing significant risks to cybersecurity and data integrity.
The Securityish Brief
The cyber campaigns, Gopher Strike and Sheet Attack, have been identified as targeting Indian government entities by a Pakistan-linked threat actor. Zscaler ThreatLabz discovered these campaigns in September 2025, noting their use of advanced techniques similar to those employed by the known APT36 group. However, researchers suggest that these activities may originate from a new subgroup or another parallel group.
Sheet Attack utilizes legitimate services like Google Sheets and Firebase for command-and-control, while Gopher Strike employs phishing emails to deliver malicious PDF documents. These documents trick users into downloading an ISO file that contains the GOGITTER downloader, which is designed to execute commands and maintain persistence on infected systems.
Once installed, GOGITTER creates a Visual Basic Script that fetches commands from pre-configured servers every 30 seconds. It also checks for the presence of a specific ZIP file and can download it from a private GitHub repository, which was created on June 7, 2025. The malicious payload is designed to evade detection by antivirus software.
GOGITTER subsequently executes a backdoor named GITSHELLPAD, which polls its command-and-control server for instructions every 15 seconds. This backdoor can execute various commands, including uploading files to the GitHub repository and running commands in the background.
The threat actor further employs a loader named GOSHELL to deliver Cobalt Strike Beacon after multiple decoding rounds. GOSHELL is designed to execute only on specific hostnames, enhancing its stealth against detection mechanisms.
Understanding the Risks
The implications of these cyber campaigns are significant for organizations, particularly those in sensitive sectors like government. The use of legitimate services for command-and-control makes detection challenging, highlighting the need for robust cybersecurity measures. Users should be vigilant about phishing attempts, especially those that mimic legitimate software updates.
Organizations should ensure that they have updated security protocols and monitor for unusual activities that could indicate a breach. The sophisticated nature of these attacks underscores the importance of employee training on recognizing phishing attempts and the necessity of implementing multi-factor authentication to safeguard sensitive data.
Key Takeaways
- Be cautious of unsolicited emails that prompt software updates, especially those with attachments.
- Regularly train employees on identifying phishing attempts and suspicious links.
- Implement multi-factor authentication to enhance security for sensitive accounts.
- Monitor network traffic for unusual activities that could indicate a breach.
- Keep software and security systems updated to defend against emerging threats.
Key Terms & Concepts
- GOGITTER: In this article, GOGITTER refers to a Golang-based downloader used in cyber attacks to establish persistence on infected systems.
- GITSHELLPAD: GITSHELLPAD is a lightweight backdoor that polls a command-and-control server for instructions and executes commands on infected machines.
- GOSHELL: GOSHELL is a bespoke Golang-based loader that delivers Cobalt Strike Beacon after multiple rounds of decoding.
- Advanced Persistent Threat (APT): An APT is a prolonged and targeted cyber attack in which an intruder gains access to a network and remains undetected for an extended period.
Read the original article here: https://thehackernews.com/2026/01/experts-detect-pakistan-linked-cyber.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
