Pak-Backed Hackers Deployed Malware Through Fake Defence Ministry Site

In the weeks leading up to and following the April 2025 Pahalgam massacre and the subsequent Operation Sindoor, a covert cyber campaign, traced to Pakistan, was quietly unfolding.

- ABHINANDAN MISHRA

With the intention to exploit the expected heightened public and institutional attention on official government updates, a Pakistan-aligned hacking group known as "APT36" launched a sophisticated phishing operation by cloning the Ministry of Defence's press release portal.

As citizens, journalists, and officials increasingly visited the site for real-time information on security developments, the attackers used the fake page to deliver malware, gaining silent access to sensitive systems at a moment when India's defence apparatus was most active—and most distracted.

The campaign began around March 2025, when cybersecurity investigators discovered a website impersonating the official Ministry of Defence press release portal. Although the fake site closely resembled the real one, it contained only a single working link—marked as the "March 2025" release.

That link led users, depending on whether they were on Windows or Linux, into a trap. In the Windows version, clicking the link opened what looked like a government warning page labelled "For Official Use Only," overlaid on a blurred image of a real ministry website. When users clicked "Continue," a hidden script silently copied a command into their system clipboard. If the victim pasted and ran the command, it triggered a remote access attack, giving the hackers control of the machine.