Topic starter
30/10/2026 2:20 pm
TL;DR: State-sponsored espionage ecosystems are using phishing, living-off-the-land techniques, memory-resident execution and cross-platform malware to maintain stealthy, durable access across Windows and Linux targets in Indian government and defense environments, according to Aryaka. Persistence, not speed, is the core advantage, and defenders need behavior-led visibility across platforms.
Editorial analysis by NHI Mgmt Group, based on content published by Aryaka: “Espionage Without Noise: Understanding APT36’s Enduring Campaigns”.
Key questions
Q: What is the first control gap that espionage ecosystems usually exploit?
A: They exploit the gap between initial delivery and durable persistence.
Q: Why do living-off-the-land techniques make long-term access harder to remove?
A: Because they blend malicious activity into trusted operating system behaviour.
Q: What signs show that persistence is working across multiple platforms?
A: Look for repeated reappearance of the same access pattern after reboot, cleanup or account changes, especially when Windows and Linux telemetry show similar tasking behaviour.
Practitioner guidance
- Deploy process-lineage monitoring for native utilities Instrument mshta.exe, script hosts and deserialisation-related execution paths so phishing-delivered payloads are visible even when no malicious file persists on disk.
- Hunt for cross-platform persistence artefacts Build detections for startup folders, scheduled tasks and systemd user services that can preserve access after reboot or cleanup.
- Correlate endpoint and network telemetry Tie process creation, service installation and outbound WebSocket sessions together so covert command-and-control cannot hide behind normal protocol use.
Bottom line: This campaign pattern shows that espionage actors are optimising for quiet, durable access rather than immediate disruption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →