{"id":7851,"date":"2025-10-22T10:00:29","date_gmt":"2025-10-22T10:00:29","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/10\/22\/pakistani-threat-actors-targeting-indian-govt-with-email-mimic-as-nic-eemail-services\/"},"modified":"2025-10-22T10:00:29","modified_gmt":"2025-10-22T10:00:29","slug":"pakistani-threat-actors-targeting-indian-govt-with-email-mimic-as-nic-eemail-services","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/10\/22\/pakistani-threat-actors-targeting-indian-govt-with-email-mimic-as-nic-eemail-services\/","title":{"rendered":"Pakistani Threat Actors Targeting Indian Govt. With Email Mimic as \u2018NIC eEmail Services\u2019"},"content":{"rendered":"

Pakistani Threat Actors Targeting Indian Govt. With Email Mimic as \u2018NIC eEmail Services\u2019
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated phishing campaign orchestrated by Pakistan-linked threat actors has been discovered targeting Indian government entities by impersonating the National Informatics Centre\u2019s email services.<\/p>\n

The operation, attributed to APT36, also known as TransparentTribe, leverages social engineering tactics to compromise sensitive government infrastructure through deceptive email communications designed to appear as legitimate NIC eEmail Services correspondence.<\/p>\n

The campaign employs carefully crafted phishing lures<\/a> that mimic official government communication channels, exploiting the trust associated with NIC\u2019s established email infrastructure.<\/p>\n

By masquerading as authentic government correspondence, the threat actors aim to trick officials into divulging credentials or downloading malicious payloads.<\/p>\n

This targeting strategy demonstrates the group\u2019s deep understanding of Indian government communication protocols and their continued focus on intelligence gathering operations against Indian administrative and defense sectors.<\/p>\n

Cyber Team analysts identified<\/a> the malicious infrastructure supporting this campaign, uncovering a network of fraudulent domains and command-and-control servers designed to facilitate credential harvesting and data exfiltration.<\/p>\n

\n
\n
\n
\n

Pakistan’s #APT36<\/a> \/ #TransparentTribe<\/a> Targeting Indian Govt. with theme “NIC eEmail Services”<\/p>\n

Infra:
accounts.mgovcloud[.]in.departmentofdefence[.]live
departmentofdefence[.]live
81.180.93[.]5 \u2014 [Stealth Server C2 on port 8080]
45.141.59[.]168@500mk500<\/a> #APT<\/a> #Malware<\/a> #ioc<\/a> pic.twitter.com\/Hn1KmVJ67o<\/a><\/p>\n

\u2014 Cyber Team (@Cyberteam008) October 16, 2025<\/a>\n<\/p><\/blockquote>\n