APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1

Why It Matters

Using legitimate cloud services like GitHub for C2 obscures malicious traffic, raising espionage risks for critical Indian infrastructure and indicating evolving tactics among Pakistan-linked actors, which forces regional defenders to upgrade detection capabilities.

Key Takeaways

• Gopher Strike uses PDFs with malicious ISO payloads.
• GOGITTER downloader fetches payloads from private GitHub repo.
• GITSHELLPAD backdoor communicates via GitHub REST API.
• GOSHELL loads Cobalt Strike only on hardcoded hostnames.
• Campaign likely from new Pakistan-linked APT subgroup.

Pulse Analysis

The Indo‑Pak cyber rivalry has entered a new phase where state‑aligned threat groups leverage mainstream development platforms to hide their operations. By exploiting public cloud services such as GitHub, attackers gain resilient, low‑cost command‑and‑control channels that blend with legitimate traffic. This trend mirrors a broader shift in advanced persistent threats, which increasingly adopt open‑source tools and cloud‑native infrastructure to evade traditional perimeter defenses and to scale their campaigns across multiple targets.

Gopher Strike’s toolset illustrates why Golang‑based malware is gaining traction. Golang binaries are compact, cross‑platform, and harder for conventional signature engines to dissect. GOGITTER acts as a stealthy downloader, pulling malicious archives from a private repository guarded by an embedded authentication token. Once on the host, GITSHELLPAD uses GitHub’s REST API to create directories, post command files, and retrieve instructions, effectively turning the repository into a bidirectional C2 hub. The final stage, GOSHELL, decodes and injects a Cobalt Strike beacon only on machines whose hostnames match a hard‑coded list, adding a layer of target discrimination that reduces noise and improves operational security.

For defenders, these tactics demand a shift from signature‑centric solutions to behavior‑based monitoring and threat‑intel integration. Detecting anomalous GitHub API calls, unusual repository activity, or rare file‑system changes such as scheduled tasks named after legitimate Windows components can provide early indicators of compromise. Zscaler’s multilayered cloud security platform now surfaces these indicators under distinct malware names, enabling security teams to block malicious downloads, quarantine infected hosts, and alert on suspicious GitHub interactions. Organizations, especially those handling sensitive government data, should reinforce endpoint monitoring, enforce strict outbound traffic policies, and incorporate threat‑hunting playbooks that address cloud‑based C2 channels to mitigate this evolving threat landscape.