New ‘Sindoor Dropper’ Malware Targets Linux Systems with Weaponized .desktop Files

A new malware campaign, dubbed “Sindoor Dropper,” is targeting Linux systems using sophisticated spear-phishing techniques and a multi-stage infection chain.

The campaign leverages lures themed around the recent India-Pakistan conflict, known as Operation Sindoor, to entice victims into executing malicious files.

This activity’s standout feature is its reliance on weaponized .desktop files, a method previously associated with the advanced persistent threat (APT) group APT36, also known as Transparent Tribe or Mythic Leopard.

The attack begins when a user opens a malicious .desktop file, named “Note_Warfare_Ops_Sindoor.pdf.desktop,” which masquerades as a standard PDF document.

According to Nextron system analysis, upon execution, it opens a benign decoy PDF to maintain the illusion of legitimacy while silently initiating a complex, heavily obfuscated infection process in the background.

This process is designed to evade both static and dynamic analysis, with the initial payload reportedly having zero detections on VirusTotal at the time of its discovery.

‘Sindoor Dropper’ Malware Targets Linux Systems

The .desktop file downloads several components, including an AES decryptor (mayuw) and an encrypted downloader (shjdfhd).

The decryptor, a Go binary packed with UPX, is intentionally corrupted by stripping its ELF magic bytes, likely to bypass security scans on platforms like Google Docs. The .desktop file restores these bytes on the victim’s machine to make the binary executable again.

This kicks off a multi-stage process where each component decrypts and runs the next. The chain includes basic anti-virtual machine checks, such as verifying board and vendor names, blacklisting specific MAC address prefixes, and checking machine uptime.

All strings within the droppers are obfuscated using a combination of Base64 encoding and DES-CBC encryption to further hinder analysis.

The final payload is a repurposed version of MeshAgent, a legitimate open-source remote administration tool. Once deployed, MeshAgent connects to a command-and-control (C2) server hosted on an Amazon Web Services (AWS) EC2 instance at wss://boss-servers.gov.in.indianbosssystems.ddns[.]net:443/agent.ashx.

This gives the attacker full remote access to the compromised system, enabling them to monitor user activity, move laterally across the network, and exfiltrate sensitive data, Nextron said.

The Sindoor Dropper campaign highlights an evolution in threat actor tradecraft, demonstrating a clear focus on Linux environments, which phishing campaigns have less targeted.

IOCs for Sindoor Dropper

By combining timely, region-specific social engineering with advanced evasion techniques, the attackers increase their likelihood of successfully compromising sensitive networks.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.