APT36: A PHISHING CAMPAIGN TARGETING INDIAN GOVERNMENT ENTITIES

Summary from the TLDR InfoSec newsletter

APT36 (Transparent Tribe), a Pakistan-linked threat group, is conducting a sophisticated phishing campaign against Indian government entities using typo-squatted domains that mimic official portals to harvest credentials and bypass Kavach MFA. The operation employs real-time OTP harvesting with C2 infrastructure hosted on Pakistani servers and coordinated domain registrations, indicating state-sponsored backing. Organizations should immediately block identified IOCs, including the domains mgovcloud[.]in and virtualeoffice[.]cloud, as well as associated IP addresses.