What is the APT36 BOSS Linux attack and how are weaponized ZIP files used to compromise systems?

APT36, a Pakistan-based threat actor group, is now targeting India's BOSS Linux systems with phishing attacks that deliver weaponized ZIP files. These ZIPs contain malicious .desktop launchers and ELF payloads that steal data and provide persistent access to infected systems. This marks a shift from Windows-focused malware to Linux-based intrusions, leveraging social engineering and unmonitored Linux environments to bypass defenses. The attack involves decoy presentations, remote command execution, screenshot capture, and Command & Control (C2) communications via malicious URLs. Organizations must deploy Linux-specific defenses and harden systems to prevent exploitation.

Security News & Threat Intelligence Jul 7, 2025 17 Add to Reading List

Who Is APT36?
How the New BOSS Linux Attack Works
Why This Technique Is Effective on Linux
Mitigation and Hardening Recommendations
Key Takeaways
Frequently Asked Questions (FAQs)

A new campaign from APT36 — also known as Transparent Tribe—has moved beyond its usual Windows malware to hit India’s Bharat Operating System Solutions (BOSS Linux). By delivering weaponized ZIP archives that hide malicious .desktop launchers, the group can steal sensitive files and maintain long‑term control of infected machines.

Below is a full breakdown of how the attack works, why it matters, and the practical steps your organization can take to defend BOSS Linux (and any other desktop Linux distribution) against similar tactics.

Who Is APT36?

Alias	Origin	Typical Targets	Notable Tools
Transparent Tribe, Mythic Leopard	Pakistan‑based threat actor	Indian government, defense, and education sectors	Crimson RAT (Windows), new BOSS.elf payload (Linux)

APT36 has been active since at least 2013. Historically, its spear‑phishing lures attached Microsoft Office documents that dropped Windows RATs. In 2025, the group expanded to Linux by focusing on BOSS, India’s Debian‑based national OS.

How the New BOSS Linux Attack Works

1. Phishing Email Delivery

Victims receive an email purporting to be a “Cyber‑Security Advisory” zip file. The file contains:

A decoy PowerPoint (Cyber‑Security‑Advisory.pptx)
A hidden .desktop launcher (named like a document)
The malicious ELF payload (BOSS.elf) hosted remotely

2. Social‑Engineering Trigger

The victim double‑clicks the .desktop file, believing it’s the slide deck. GNOME/KDE executes it if the user ignores security prompts or has “Allow launching” enabled.

3. Drop & Execute

The launcher runs /bin/bash –c commands to:

Download the decoy PowerPoint and open it in LibreOffice – distracts the user.
Pull the BOSS.elf binary from the attacker’s server (govin.soralstore[.]com) to /tmp.
Make it executable (chmod +x) and spawn it (nohup ./client.elf &).

4. C2 Communication

BOSS.elf establishes a TCP connection to 101[.]99[.]92[.]182:12520. Capabilities observed:

System reconnaissance (OS, CPU, user list)
Screenshot capture & exfil
File download/upload
Shell command execution

5. Persistence

The malware copies itself to ~/.config/.cache/ and adds a hidden autostart .desktop entry so it relaunches at each login.

Why This Technique Is Effective on Linux

Traditional Windows Lure	New Linux Lure
Malicious macros in Office docs	Malicious `.desktop` files marked executable
User relies on AV/EDR alerts	Many Linux desktops lack real‑time AV
Familiar to blue teams	Less logging & fewer rules for Linux desktop threats

Linux users often assume fewer threats exist, so attack surface hardening may be lax (no email sandbox, default launcher prompts disabled, no endpoint agent).

Mitigation and Hardening Recommendations

Email and Attachment Controls

Block or quarantine ZIP attachments containing hidden .desktop files.
Use content disarm and reconstruction (CDR) or cloud sandboxing for all inbound archives.

Desktop Environment Settings

In GNOME Files (“Nautilus”), uncheck “Allow executing file as program” for unknown downloads.
Disable automatic thumbnailing of executables.

Endpoint Protection

Deploy Linux‑capable EDR/AV (ClamAV with fresh sigs, Sophos AV for Linux, or open‑source Falco).
Monitor for unusual outbound ports (e.g., :12520) and new autostart entries in ~/.config/autostart/.

File Integrity Monitoring

Use tools like AIDE or inotifywait to detect changes in critical paths such as /tmp or hidden directories in $HOME.

Network Security

Block known APT36 C2 ranges and domains.
Apply deep packet inspection to spot ELF uploads/downloads in HTTP traffic.

User Awareness

Run phishing simulations tailored to Linux staff and emphasize the risks of double‑clicking unknown .desktop files.

Key Takeaways

APT36 is now cross‑platform — don’t assume threat actors stay Windows‑only.
.desktop files can be weaponized just like Windows shortcuts or macros.
BOSS Linux needs enterprise‑grade defenses: email filtering, EDR, and user training.
Zero Trust applies to endpoints too—verify every binary, even in national OS distributions.

By tightening launcher permissions, monitoring for suspicious ELF downloads, and educating users, organizations can block APT36’s latest playbook and keep sensitive data out of enemy hands.

FAQs:

What is the APT36 BOSS Linux attack?

APT36 is targeting BOSS Linux systems using phishing emails with malicious ZIP files containing .desktop launchers and ELF binaries to steal sensitive data.

Who is behind the BOSS Linux malware campaign?

APT36, also known as Transparent Tribe, a Pakistan-based APT group, is behind the attack.

What is BOSS.elf?

BOSS.elf is the malicious Linux payload dropped during the attack, used for data exfiltration and remote command execution.

How does the malicious ZIP file work?

The ZIP file includes a decoy PowerPoint and a disguised .desktop file that downloads and executes the BOSS.elf payload.

What are `.desktop` files in Linux?

.desktop files are shortcut launchers used by Linux desktop environments; attackers can weaponize them to execute malicious code.

What is the role of LibreOffice in the attack?

The decoy PowerPoint is opened in LibreOffice to distract the user while the malicious payload is downloaded in the background.

What is the IP address used in the attack?

The malware communicates with a C2 server at 101.99.92[.]182:12520.

How can I detect if I'm compromised?

Check for .safepay extensions, unknown .desktop launchers, and outbound connections to suspicious IP addresses.

What are Indicators of Compromise (IOCs) for this attack?

IOCs include .desktop files executing curl commands, BOSS.elf downloads, and connections to 101.99.92[.]182.

Is this attack targeting only BOSS Linux?

Currently, the campaign focuses on BOSS Linux, but similar methods can affect other Linux distributions.

What is the risk level of this APT36 attack?

The attack is considered high-risk due to stealth tactics, persistent access, and targeting of sensitive government data.

How to protect Linux systems from phishing attacks?

Use email filters, disable .desktop auto-launch, and restrict execution permissions on downloads.

Can Linux antivirus tools detect BOSS.elf?

Modern EDR/AV solutions with updated signatures may detect BOSS.elf; traditional Linux environments without AV are at risk.

What are the commands used in the attack script?

Commands include downloading the ELF binary with curl, executing it with bash, and hiding it using nohup.

What is the decoy file in the ZIP?

The ZIP includes a fake PowerPoint titled “Cyber-Security-Advisory.pptx.”

Is the attack ongoing in 2025?

Yes, reports from 2024 and 2025 confirm active campaigns using these methods.

What tools are used in the attack?

Curl, bash, ELF binaries, and .desktop launchers are used for payload delivery and execution.

How does the malware persist after reboot?

It installs itself into the autostart directory using hidden .desktop files.

What email subjects are used in phishing?

Subjects often reference cybersecurity alerts or national security documents.

How to block malicious ZIP files?

Use secure email gateways to detect .desktop files inside ZIPs and sandbox suspicious archives.

What Linux hardening tips can stop APT36?

Restrict script execution, disable launcher execution by default, and monitor suspicious network activity.

How to remove the malware?

Terminate active connections, delete the payloads, scan with EDR, and review autostart files.

Is this attack affecting Windows systems?

No, this campaign is Linux-specific, but APT36 has historically targeted Windows too.

What are `.elf` files?

.elf files are Linux Executable and Linkable Format files, similar to .exe files in Windows.

Is BOSS Linux secure?

Like any OS, BOSS is secure if properly hardened, monitored, and updated.

What sector is most targeted by APT36?

Government, education, defense, and research sectors are top targets.

What makes Linux desktops vulnerable?

Lack of antivirus, reliance on default permissions, and user trust in system prompts.

Can firewalls block these attacks?

Yes, blocking outbound C2 IPs and suspicious ports like 12520 helps prevent data exfiltration.

What should organizations do immediately?

Update systems, disable .desktop execution, deploy Linux EDR, and educate users.

How do `.desktop` files bypass detection?

They look like safe documents and can run silently with terminal access hidden.

Are there tools to monitor for ELF malware?

Yes, tools like rkhunter, chkrootkit, and open-source EDR agents are effective.