---
id: 6226
title: "APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor"
source_domain: hunt.io
source_url: "https://hunt.io/blog/apt36-india-infrastructure-attacks"
published_at: "2025-07-31T00:00:00Z"
tags: ["phishing", "india", "apt36", "transparent-tribe", "poseidon-backdoor", "desktop-files"]
phying_url: "https://phying.com/item/6226"
lang: en
---

# APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor

## Summary

APT36 expands beyond military targets to Indian Railways, oil and gas, and the Ministry of External Affairs, using .desktop lures, cron persistence, and the Poseidon backdoor.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-07-31T00:00:00Z
- **Original:** https://hunt.io/blog/apt36-india-infrastructure-attacks
- **Phying News:** https://phying.com/item/6226