New analyses tie the activity to APT36, detailing booby-trapped desktop shortcuts that install a Go backdoor on Indian government systems.