Researchers at Volexity have recently reported on a Linux malware strain named “DISGOMOJI” which has been observed targeting government agencies in India. The threat actor behind the campaign is believed to be a Pakistan-based threat actor dubbed “UTA0137”. UTA0137 leverages an open-source command-and-control (C2) project “discord-c2”, which uses Discord as the C2 server. The attackers communicate with DISGOMOJI malware via emojis, coding each emoji to represent a command. Examples include an emoji of a man running which executes a command on the victim’s device, an emoji of a camera which takes a screenshot of the victim’s screen, and a fire emoji which finds and sends all files matching an extension list to the attacker. Other capabilities of the DISGOMOJI malware includes zipping Firefox profiles on the victim’s device and downloading/uploading additional files. The malware has been observed as part of a phishing campaign targeting government agencies in India. Volexity believes that the malware was built to target a custom Linux distribution named BOSS which Indian government agencies use for their desktop. The campaign begins with a spear-phishing email that contains a ZIP archive. When unzipped, a Golang ELF binary downloads the DISGOMOJI malware from a remote server while displaying a benign PDF document consistent with the attacker’s pretext. Volexity notes that UTA0137 has been improving the DISGOMOJI over time, and that the malware has been successfully deployed in several attacks. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.