APT36 Malicious Desktop File Execution

Tim Peck@timpeck

•updated Oct 20, 2025•4•1•121

Detects the execution of a shell command characteristic of APT36's use of malicious .desktop files on Linux. The command typically involves using 'curl' to download a hex-encoded payload and 'chmod' to make it executable, often within the a tmp directory.