A sophisticated cyber campaign dubbed Operation Sindoor has emerged as one of the most significant state-sponsored attacks targeting India’s critical infrastructure in 2025.
The operation, orchestrated by Pakistan-aligned threat groups APT36 and Sidecopy, launched its initial assault on April 17, 2025, before escalating into a coordinated digital siege that peaked between May 7-10.
The threat actors deployed precision-guided malware campaigns targeting India’s defense, government IT infrastructure, healthcare, telecommunications, and education sectors.
Using weaponized documents disguised as legitimate communications, the attackers exploited recent national tragedies, including the Pahalgam Terror Attack, to craft compelling social engineering lures that bypassed traditional security measures.
Seqrite analysts identified a marked evolution in APT36’s tactical approach, noting the group’s transition from legacy Poseidon loaders to the more sophisticated Ares malware framework.
This modular, evasive system represents a significant upgrade in the threat landscape, offering enhanced stealth capabilities and remote access functionality.
The campaign generated over 650 confirmed DDoS and defacement events, involving 35 hacktivist groups operating under hashtags like #OpIndia and #OperationSindoor.
.webp)
The attackers established an extensive digital infrastructure featuring spoofed domains that mimicked trusted Indian entities, including nationaldefensecollege[.]com and zohidsindia[.]com, designed to exploit user trust and facilitate credential harvesting.
.webp)
Advanced Infection Mechanism Analysis
The malware deployment process reveals sophisticated multi-stage execution tactics. Initial access vectors utilized spear-phishing attachments containing malicious file types including .ppam, .xlam, .lnk, .xlsb, and .msi formats.
These files triggered embedded macros that executed web queries to command-and-control infrastructure, specifically targeting fogomyart[.]com/random.php for payload retrieval.
The Ares RAT establishes persistent communication channels through callback IP 167.86.97[.]58:17854, enabling comprehensive system compromise including keylogging, screen capture, file manipulation, and credential theft.
The malware leverages Living-off-the-Land Binaries (LOLBins), scheduled tasks for persistence, UAC bypasses, and obfuscated PowerShell scripts to maintain prolonged access while evading detection systems.
This coordinated campaign demonstrates the convergence of nation-state espionage with hacktivist disruption, marking a concerning evolution in cyber warfare tactics targeting democratic institutions and critical infrastructure.
Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here
