Executive Summary
An open directory hosted at 193.29.104[.]84 exposed a multi-stage cyber espionage toolkit attributed to the DoNot APT (APT-C-35) group. The campaign, which evolved through mid-October 2026, utilized a sophisticated array of Go-based reverse shells, custom HTTP C2 implants, and automated scripts specifically designed to target Pakistan's strategic infrastructure.
The technical analysis revealed a heavy reliance on credential harvesting via LLMNR/NBNS poisoning and extensive internal reconnaissance. Significant efforts were directed toward impersonating the Oil and Gas Development Company Limited (OGDCL) to blend into local network environments. Hardcoded keyword searches in the actor's scripts confirm a primary interest in Pakistan Atomic Energy Commission (PAEC) facilities, including the Chashma and KANUPP nuclear power plants.
This activity represents a high-priority threat to South Asian critical infrastructure, specifically in the nuclear and energy domains. The group demonstrates iterative development of their tooling, increasingly employing symbol stripping and TLS encryption to evade detection during command-and-control communications.