Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft.
The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025.
"While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) group, APT36, we assess with medium confidence that the activity identified during this analysis might originate from a new subgroup or another Pakistan-linked group operating in parallel," researchers Sudeep Singh and Yin Hong Chang said.
Sheet Attack gets its name from the use of legitimate services like Google Sheets, Firebase, and email for command-and-control (C2). On the other hand, Gopher Strike is assessed to have leveraged phishing emails as a starting point to deliver PDF documents containing a blurred image that's superimposed by a seemingly harmless pop-up instructing the recipient to download an update for Adobe Acrobat Reader DC.
The main purpose of the image is to give the users an impression that it's necessary to install the update in order to access the document's contents. Clicking the "Download and Install" button in the fake update dialog triggers the download of an ISO image file only when the requests originate from IP addresses located in India and the User-Agent string corresponds to Windows.
"These server-side checks prevent automated URL analysis tools from fetching the ISO file, ensuring that the malicious file is only delivered to intended targets," Zscaler said.
The malicious payload embedded within the ISO image is a Golang-based downloader dubbed GOGITTER that's responsible for creating a Visual Basic Script (VBScript) file if it does not already exist in the following locations: "C:\Users\Public\Downloads," "C:\Users\Public\Pictures," and "%APPDATA%." The script is designed to fetch VBScript commands every 30 seconds from two pre-configured C2 servers.
GOGITTER also sets up persistence using a scheduled task that's configured to run the aforementioned VBScript file every 50 minutes. In addition, it ascertains the presence of another file named "adobe_update.zip" in the same three folders. If the ZIP file is not present, it pulls the archive from a private GitHub repository ("github[.]com/jaishankai/sockv6"). The GitHub account was created on June 7, 2025.
Once the download is successful, the attack chain sends an HTTP GET request to the domain "adobe-acrobat[.]in" likely to signal the threat actors that the endpoint has been infected. GOGITTER then extracts and executes "edgehost.exe" from the ZIP file. A lightweight Golang-based backdoor, GITSHELLPAD, leverages threat actor-controlled private GitHub repositories for C2.
Specifically, it polls the C2 server every 15 seconds by means of a GET request to access the contents of a file named "command.txt." It supports six different commands -
- cd .., to change working directory to the parent directory
- cd, to change directory to the specified path
- run, to run a command in the background without capturing the output
- upload, to upload a local file specified by the path to the GitHub repository
- download, to download a file to the specified path
- default case, to run a command using cmd /c and capture the output
The results of the command execution are stored in a file called "result.txt" and uploaded to the GitHub account via an HTTP PUT request. The "command.txt" is then deleted from the GitHub repository once the command is successfully executed.
Zscaler said it observed the threat actor also downloading RAR archives using cURL commands after gaining access to the victim's machine. The archives include utilities to gather system information and drop GOSHELL, a bespoke Golang-based loader used to deliver Cobalt Strike Beacon after multiple rounds of decoding. The tools are wiped from the machine after use.
"GOSHELL's size was artificially inflated to approximately 1 gigabyte by adding junk bytes to the Portable Executable (PE) overlay, likely to evade detection by antivirus software," the cybersecurity company said. "GOSHELL only executes on specific hostnames by comparing the victim's hostname against a hard-coded list."
Sheet Attack Uses Google Sheets, Firebase, Microsoft Graph API for C2
In a follow-up analysis, Zscaler ThreatLabz detailed the Sheet Attack campaign, highlighting the use of three new backdoors codenamed SHEETCREEP, FIREPOWER, and MAILCREEP, along with a PowerShell-based document stealer to exfiltrate files. A brief description of their functionality is as follows -
- SHEETCREEP, a lightweight backdoor written in C# that uses Google Sheets for C2 to execute commands using "cmd.exe"
- FIREPOWER, a PowerShell-based backdoor that abuses Google's Firebase Realtime Database for C2 to execute commands to be executed using and download files
- MAILCREEP, a Golang-based backdoor that leverages the Microsoft Graph API for C2 and manipulate mails
"The Sheet Attack campaign leveraged PDFs to deploy lightweight backdoors that utilized multiple C2 channels that abused legitimate cloud services from Google and Microsoft, enabling the network traffic to blend in and evade security controls," the researchers said.
Like in the case of Gopher Strike, the attack chain makes use of a geofencing check that uses the "User-Agent" string to ensure that the malicious ZIP archive is distributed only to Windows users in India. Present within the archive is a Windows shortcut (LNK) that poses as a document to trigger the infection. The LNK file, once launched, is responsible for deploying the SHEETCREEP backdoor.
The Google Sheet C2 channel, for its part, has been found to serve repeated commands, in some cases containing typos (e.g., "whaomi" and "whomai" instead of "whoami"), raising the possibility that of hands-on-keyboard activity from an operator. However, recent Sheet Attack campaigns have transitioned from SHEETCREEP to using malicious LNK files to distribute FIREPOWER, with the latter also serving as a conduit for a PowerShell-based document stealer and MAILCREEP to select targets.
Further analysis of SHEETCREEP and FIREPOWER's source code has revealed the presence of emojis within its error-handling logic and verbose comments, respectively, suggesting the use of generative artificial intelligence (AI) tools for malware development.
"While both campaigns share TTPs with APT36, their concurrent operation alongside traditional APT36 activity, use of new tools, and potential generative AI in malware development suggest an evolution of APT36 or the emergence of a closely aligned group," Zscaler concluded.
(The story was updated after publication on February 10, 2026, to include details of the Sheet Attack campaign.)
