APT36 "Vibeware" Campaign: AI-Assisted Malware Industrialization Targets Indian and Afghan Government
APT36 "Vibeware" Campaign (TL-2026-2123), also tracked as Vibeware, is a high-severity advanced persistent threat campaign, first published 2026-03-05. It is attributed to APT36 (Pakistan) with medium confidence, affects Google Chrome, maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1053.005), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2123
- Threat ID
- TL-2026-2123
- Also known as
- Vibeware, Operation Vibeware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-05
- Last reviewed
- 2026-03-05
- Attribution
- APT36
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, diplomatic, military, private-sector
- Target regions
- South Asia, india, afghanistan
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in APT36 "Vibeware" Campaign
Malware and tooling: BackupSpy, CreepDropper, CrystalFile, CrystalShell, Gate Sentinel Beacon, LuminousCookies, LuminousStealer, MAILCREEP, NimShellcodeLoader, SHEETCREEP, SupaServ, Warcode
Bitdefender documents APT36 (Transparent Tribe), a Pakistan-aligned threat actor, operating an AI-assisted malware development pipeline codenamed "Vibeware" that produces new implants at a near-daily cadence, described by researchers as a form of "Distributed Denial of Detection." At least 14 malware families written in Nim, Zig, Crystal, Rust, Go, and .NET abuse Discord, Slack, Google Sheets, Supabase, and Firebase for C2, and one component bypasses Chrome's App-Bound Encryption to steal browser cookies, targeting Indian government bodies and embassies, the Afghan government, and private businesses for army personnel, diplomatic, and defense/national-security data.
How APT36 "Vibeware" Campaign works
Bitdefender's "APT36: A Nightmare of Vibeware" (published 2026-03-05) documents an AI-assisted malware development model attributed with medium confidence to APT36 (Transparent Tribe), a Pakistan-aligned espionage actor active since at least 2013. Rather than investing in a small number of polished tools, the actor uses LLMs and AI-integrated development tooling to rewrite similar malicious logic across niche and mainstream programming languages -- Nim, Zig, Crystal, Rust, Go, and .NET -- producing a stream of functionally sufficient but frequently buggy implants intended to reset detection-engine baselines with every recompilation in a different language runtime.
At least 14 distinct malware families were identified: Warcode (Crystal, a Havoc-framework loader previously seen in earlier APT36 campaigns and staged as C:\Users\Public\AccountPictures\warcode.exe), NimShellcodeLoader (Nim), CreepDropper (.NET), MailCreep (Go, a browser-credential stealer abusing the Microsoft Graph API, shipped with a template placeholder in place of a real C2 URL that leaves it unable to exfiltrate anything -- direct evidence of unreviewed AI-generated code), SheetCreep (C#, a bidirectional Google Sheets C2 hub using DES-ECB-encrypted cell data and a reverse-byte-ordered PE payload disguised as an image file, ds.png), SupaServ (Rust, Supabase-primary/Firebase-backup C2), LuminousStealer (Rust, stages stolen data in a local SQLite database before exfiltrating file contents via Google Drive and metadata via Firebase), CrystalShell and ZigShell (Crystal/Zig, near-identical Base64-command-prefix bots for Discord and Slack respectively, both requiring Discord User ID verification and both containing broken "online status" and master-election logic), CrystalFile (Crystal, polls C:\Users\Public\AccountPictures\input.txt for commands and never cleans up its temp output), LuminousCookies (Rust, a Chrome App-Bound Encryption bypass), BackupSpy (Rust, stages collected files under C:\Users\Public\systemTemp), ZigLoader (Zig), and Gate Sentinel Beacon (a Go server / C client C2 pair modeled on the open-source GateSentinel project).
Initial access is via spearphishing email carrying .LNK files inside ZIP or ISO containers, or PDF lures with a "Download Document" button that redirects through attacker-controlled sites to an external archive. Execution relies on fileless PowerShell and process injection (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread); persistence uses Windows Scheduled Tasks under names such as DateAndTimeService, personalServiceTask, and MicrosoftEdgesUpdatesTasksMachine*, plus modified .LNK shortcuts targeting Chrome, Edge, and Brave. LuminousCookies defeats Chrome's App-Bound Encryption (introduced in Chrome 127) by spawning a suspended browser process and using LoadLibrary injection to load a modified decryptor DLL that masquerades as a legitimate browser component -- a technique adapted from the public xaitax/Chrome-App-Bound-Encryption-Decryption proof of concept, though the researchers note the LoadLibrary-injection approach cannot pass the pipe-name argument the standard ABE decryptor expects via DllMain, forcing a hard-coded workaround.
Collection targets .txt, .docx, .pdf, .png, .jpg, .xlsx, .pptx, .zip, .rar, .doc, and .xls files via recursive directory scanning, plus PowerShell-driven screenshot and audio capture. Exfiltration and C2 both route through abused legitimate cloud services -- Discord, Slack, Google Sheets, Supabase, Firebase, and Google Drive -- with tmpfiles.org used for auxiliary tool hosting and slackin.online (fronted by Azure Front Door) as a Slack-C2-adjacent domain. Attribution to APT36 rests on Warcode's reuse of a Havoc-framework loader previously tied to the group and a recurring "Nightmare" persona across actor infrastructure. Primary targets are Indian government bodies and embassies; secondary targets are the Afghan government and private businesses, with attacker interest concentrated on army personnel records, foreign-affairs/diplomatic material, and defense/national-security documents.
MITRE ATT&CK techniques used in TL-2026-2123
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1547.009 Boot or Logon Autostart Execution: Shortcut Modification
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File
Collection
T1113 Screen Capture; T1119 Automated Collection; T1123 Audio Capture
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
T1566.001 Phishing: Spearphishing Attachment
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Command and Control
T1573.001 Encrypted Channel: Symmetric Cryptography
Resource Development
Affected products and versions in APT36 "Vibeware" Campaign
- Google — Chrome
Vulnerable versions: >=127 (App-Bound Encryption) - Microsoft — Edge
Vulnerable versions: Chromium-based builds targeted by LNK-persistence and ABE-bypass tooling - Brave Software — Brave Browser
Vulnerable versions: Chromium-based builds targeted by LNK-persistence and ABE-bypass tooling
Remediation for APT36 "Vibeware" Campaign
Immediate actions
- Block network egress/callbacks to the identified Havoc C2 IP 23.152.0.81 and the ZigShell-adjacent domain slackin.online.
- Hunt for the identified scheduled task names (DateAndTimeService, personalServiceTask, MicrosoftEdgesUpdatesTasksMachine*) and staging paths (C:\Users\Public\AccountPictures, C:\Users\Public\systemTemp, C:\Users\Public\Downloads).
- Alert on outbound connections to Discord, Slack, Supabase, Google Sheets, and Firebase API endpoints originating from non-browser or unsigned processes.
- Quarantine and detonate .LNK files delivered inside ZIP/ISO email attachments in a sandbox before allowing execution on endpoints.
Workarounds
- Restrict ISO/IMG auto-mount from email attachments via Group Policy / Windows Attack Surface Reduction rules.
- Enforce SmartScreen and disable auto-execution of downloaded shortcut (.LNK) files where feasible.
Longer-term hardening
- Deploy EDR/behavioral detection tuned to catch niche-language (Nim/Zig/Crystal/Rust) compiled binaries, which routinely evade signature-based engines through baseline resets.
- Implement application allow-listing and PowerShell constrained-language/script-block-logging policies to curb fileless execution and CreateRemoteThread-based process injection.
- Monitor for unauthorized .LNK-shortcut modification targeting browser executables (Chrome, Edge, Brave) as a persistence indicator.
Timeline of APT36 "Vibeware" Campaign
- SheetCreep sample compiled (timestamp 2025-10-28 09:58:46), the earliest dated Vibeware artifact identified by Bitdefender researchers.
- Initial CrystalShell variants observed with hardcoded Discord bot tokens, the earliest identified use of Discord as a Vibeware C2 channel (exact day within December 2025 not specified in source).
- CrystalShell/ZigShell Discord and Slack C2 messaging traffic begins, continuing through the report's publication.
- CrystalShell Slack variant compiled, extending the Discord-based bot's protocol to Slack.
- LuminousStealer and LuminousCookies samples compiled, introducing Firebase/Google Drive exfiltration and the Chrome App-Bound Encryption bypass to the Vibeware toolset.
- Further CrystalShell activity observed against Indian government targets.
- Updated LuminousCookies injector sample compiled.
- New ZigShell variants compiled, continuing the actor's near-daily recompilation cadence.
- Bitdefender publishes "APT36: A Nightmare of Vibeware," the first public documentation of the AI-assisted Vibeware development pipeline and its 14+ malware families.
- Cloud Security Alliance publishes a companion technical report, "AI-Assisted Malware Industrialization: The Vibeware Threat Model."
Sources cited for APT36 "Vibeware" Campaign
- APT36: A Nightmare of Vibeware
- Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM, Group G0134
- AI-Assisted Malware Industrialization: The Vibeware Threat Model
- Bitdefender Uncovers "Vibeware": A New AI-Driven APT Attack Strategy Flooding South Asia With Polyglot Implants
- APT36 unleashes AI-generated 'vibeware' to flood targets
- xaitax/Chrome-App-Bound-Encryption-Decryption
- HavocFramework/Havoc
- kyxiaxiang/GateSentinel
Threats related to APT36 "Vibeware" Campaign
Detection coverage for TL-2026-2123
As of 2026-03-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2123 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.