TL;DR: State-sponsored espionage ecosystems are using phishing, living-off-the-land techniques, memory-resident execution and cross-platform malware to maintain stealthy, durable access across Windows and Linux targets in Indian government and defense environments, according to Aryaka. Persistence, not speed, is the core advantage, and defenders need behavior-led visibility across platforms.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Aryaka's blog post: State-sponsored espionage ecosystems are combining phishing, living-off-the-land execution and cross-platform malware to sustain covert access against Indian government and defense targets.
Why it matters: This matters because identity-adjacent persistence techniques turn ordinary endpoints and administrative workflows into long-lived footholds, so IAM, PAM and SOC teams need detection that sees beyond file-based malware signatures.
Context
Espionage campaigns increasingly rely on persistence and stealth rather than noisy disruption. In this case, the problem is not a single exploit chain but an operating model that blends legitimate tooling, remote access malware and cross-platform delivery to stay hidden inside essential environments.
For identity and security programmes, the key governance gap is that traditional endpoint and perimeter controls often detect the payload, not the access pattern. When attackers live off the land, reuse trusted components and survive reboots, the control problem becomes behavioural rather than purely technical.
Key questions
Q: What is the first control gap that espionage ecosystems usually exploit?
A: They exploit the gap between initial delivery and durable persistence. If defenders only look for obvious malware files, they miss phishing-delivered loaders that use legitimate system utilities, memory-resident execution and startup mechanisms to survive cleanup. The first priority is to monitor execution paths, not just payloads, because the foothold is often established before traditional alerts trigger.
Q: Why do living-off-the-land techniques make long-term access harder to remove?
A: Because they blend malicious activity into trusted operating system behaviour. When attackers launch code through native utilities and standard services, the environment itself becomes part of the concealment layer. Removal gets harder because the visible artefact may be only the control path, while the actual persistence sits in normal administration mechanisms.
Q: What signs show that persistence is working across multiple platforms?
A: Look for repeated reappearance of the same access pattern after reboot, cleanup or account changes, especially when Windows and Linux telemetry show similar tasking behaviour. A durable campaign will also leave correlated startup artefacts, recurring outbound sessions and recurring host profiling activity, even when individual payloads change.
A: Use both, but do not let either one become the sole source of truth. Endpoint telemetry exposes process ancestry, service creation and memory execution, while network telemetry reveals tasking, heartbeat traffic and structured exfiltration. Together they show whether an implant is merely present or actively being operated.
Technical breakdown
How living-off-the-land execution hides malware
Living-off-the-land execution uses legitimate operating system utilities to launch malicious code, reducing the visibility that signature-based controls depend on. In the Windows campaign, mshta.exe and XAML deserialization were used to move from phishing delivery into in-memory payload execution. That matters because the process lineage looks normal until the malicious behaviour is already underway, which weakens controls that focus only on file detection or known-bad hashes.
Practical implication: Prioritise process ancestry, script-host monitoring and telemetry on native utilities that attackers can abuse.
Why cross-platform persistence changes the defensive model
Cross-platform persistence means the same threat actor can keep a foothold in both Windows and Linux environments, using different implant families but the same operational objective. Aryaka describes layered startup mechanisms on Windows and systemd user services on Linux, which lets the actor survive reboots and blend into normal administration. The technical problem is not just persistence itself, but persistence that looks like ordinary system behaviour across different operating systems.
Practical implication: Correlate persistence artefacts across platforms instead of treating Windows and Linux as separate detection problems.
How covert command-and-control supports long-term espionage
Command-and-control channels matter because they determine whether the attacker can quietly task the implant, collect telemetry and exfiltrate data without creating noisy network signals. Aryaka's example of WebSocket-based command-and-control shows how structured heartbeat traffic can look like routine application communication. That raises the bar for network monitoring, because defenders must distinguish legitimate application messaging from remote operator control.
Practical implication: Inspect outbound channels for protocol use that fits the application but not the asset's normal business role.
Threat narrative
Attacker objective: The objective is durable covert access for espionage, surveillance and intelligence collection rather than immediate destruction.
- Entry begins with spear-phishing emails that deliver LNK and HTA files, giving the operator an initial foothold on targeted systems.
- Credential or access abuse is replaced by trusted utility abuse, with mshta.exe, XAML deserialization and in-memory execution used to avoid obvious malware artefacts.
- Escalation and persistence are maintained through layered startup mechanisms on Windows and systemd user services on Linux, preserving access across reboots.
- Impact is long-term intelligence collection, recursive system profiling and structured data exfiltration from Indian government and defense-aligned environments.
Breaches seen in the wild
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
- reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Espionage ecosystems are a governance problem, not just a malware problem. The article describes a cluster of operators that adapt tools, delivery methods and persistence across platforms while keeping the same strategic objective. That means security teams are dealing with a sustained access model, not a one-off intrusion. Detection, containment and identity governance all need to assume that the adversary is optimising for endurance, not speed.
Persistence is the control gap these campaigns exploit. The Windows and Linux examples both show attackers embedding themselves into normal startup and execution paths so they survive reboot, cleanup and routine administration. That makes the real failure mode a standing foothold that outlives initial compromise, which is exactly where CI/CD pipeline identity security thinking helps defenders reason about trusted execution paths and durable access.
Cross-platform tradecraft is now a baseline expectation for mature espionage actors. Aryaka's example is notable because the same ecosystem spans Windows and Linux while maintaining consistent surveillance outcomes. Defenders should stop treating platform boundaries as containment boundaries. The practitioner implication is to govern identity, telemetry and response as a single operational fabric across endpoints and server estates.
Host telemetry is becoming an espionage channel in its own right. Desk RAT's emphasis on system diagnostics and WebSocket-based operator messaging shows how attackers increasingly turn ordinary telemetry into their reconnaissance feed. That creates a named failure mode: the verification trust gap, where defenders assume routine telemetry is benign even when it is being used to support covert tasking. The practitioner implication is to classify outbound telemetry by purpose, not by protocol alone.
Behaviour-led defence is now the minimum viable response model. Traditional file-based detection cannot keep pace when the attacker operates through legitimate Windows components, memory-resident code and normal-looking Linux services. The field should treat behaviour, process ancestry and persistence artefacts as first-class governance signals. Practitioners who still anchor their programme on known-bad artefacts will miss the ecosystem, not just the campaign.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: AI Supply Chain Security and AI-BOM Guide
What this signals
Persistent espionage requires a control model that spans identity, endpoint and network layers. The defenders' task is no longer just to block delivery. They need to understand where trusted execution, service creation and operator tasking intersect, because that is where stealthy access survives. Behavioural correlation, not isolated alerts, becomes the practical control plane.
Verification trust gap: when host telemetry is treated as inherently benign, attackers can use it as a covert channel for reconnaissance and command-and-control. That creates a programme-level blind spot because the same data defenders rely on can be repurposed by the adversary. Security teams should classify telemetry by business purpose and anomaly profile, not by protocol name alone.
If espionage actors can operate across Windows and Linux with the same strategic objective, then platform-specific governance will always lag behind the threat. The programme response is to unify detection logic, persistence hunting and response playbooks around access patterns, not operating-system silos.
For practitioners
- Deploy process-lineage monitoring for native utilities Instrument mshta.exe, script hosts and deserialisation-related execution paths so phishing-delivered payloads are visible even when no malicious file persists on disk.
- Hunt for cross-platform persistence artefacts Build detections for startup folders, scheduled tasks and systemd user services that can preserve access after reboot or cleanup.
- Correlate endpoint and network telemetry Tie process creation, service installation and outbound WebSocket sessions together so covert command-and-control cannot hide behind normal protocol use.
- Prioritise high-risk supplier and partner pathways Review third-party connections, remote support channels and externally delivered artefacts that can become the initial delivery path for espionage tooling.
Key takeaways
- This campaign pattern shows that espionage actors are optimising for quiet, durable access rather than immediate disruption.
- The combination of phishing, living-off-the-land execution and cross-platform persistence makes file-based detection insufficient on its own.
- Teams need behavioural correlation across endpoints, services and network sessions to catch access that survives reboot and cleanup.
Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Supply Chain Security and AI-BOM Guide · CI/CD Pipeline Identity Security Guide · Shai Hulud npm malware campaign
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0003; TA0006; TA0010 — Initial Access; Persistence; Credential Access; Exfiltration | The article centres on phishing delivery, persistence, covert access and data theft behaviours. |
| Recommendation — Map the observed campaign chain to ATT&CK tactics and tune detections around persistence and exfiltration stages. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect anomalies, indicators of compromise, and other potentially adverse events | The article depends on behavioural monitoring across endpoint and network telemetry. |
| Recommendation — Strengthen anomaly monitoring so multi-stage espionage activity is detected through correlated telemetry. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The campaign's stealth depends on defenders seeing process and service activity clearly. |
| Recommendation — Centralise endpoint and service logs so persistence and operator tasking can be investigated consistently. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | This activity is only visible if teams analyse logs for anomalous execution and exfiltration patterns. |
| SI-4 — System Monitoring | System monitoring is the main control family for detecting living-off-the-land and memory-resident tradecraft. | |
| Recommendation — Review audit records for repeated startup, process and network patterns that indicate covert access. Use system monitoring to catch native-tool abuse and memory-only execution before persistence hardens. | ||
Key terms
- Living Off The Land Technique: Living Off The Land Technique is an attack method where an adversary uses tools already present in a target environment instead of introducing obvious malware. It relies on legitimate system utilities, scripts, admin features, and trusted services to blend in with normal activity, making detection harder and forensic separation from routine operations more difficult.
- Systemd Persistence: Systemd persistence is the use of Linux service units to relaunch malicious code automatically after a reboot or service restart. It matters because it converts a one-time compromise into recurring execution, making removal harder unless service configuration and ownership are reviewed.
- Command And Control Channel: A command and control channel is a communication path an attacker uses to send instructions to compromised systems and receive results back. In cloud and AI workloads, that path can be built through legitimate services such as storage, APIs, or object exchange rather than direct network sockets.
- Memory-Resident Execution: Memory-resident execution means code is running in a process’s memory without leaving a normal file artifact behind. Security teams treat this as a high-risk behavior because it can bypass controls that depend on scanning files, hashes, or downloaded binaries.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps practitioners connect access governance, secrets handling and runtime identity decisions to broader security operations.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org