CrimsonRAT
CrimsonRAT is a Windows .NET-based remote access trojan used by Transparent Tribe/APT36, a suspected Pakistan-linked threat actor, and has been described as the group’s primary malware since at least 2020 and its malware of choice for establishing long-term access in victim networks. Reported delivery has relied on spear-phishing and phishing attacks, including malicious Office documents with VBA macros that extract an embedded archive, unzip it, and execute the payload. Campaigns cited in the content targeted Indian entities, including defense, government, critical infrastructure, and educational institutions/students, and the group has historically targeted government employees, military personnel, think tanks, conferences, and also used CrimsonRAT against human rights activists in Pakistan. Documented capabilities include directory and drive listing, process listing, screenshot capture, file read/write/delete, arbitrary command execution, exfiltration to command-and-control servers, and the ability to run or manage keylogger and USB-related modules while reporting their presence or versions to C2. The content also notes overlap in maldocs and macros with ObliqueRAT campaigns, and places CrimsonRAT in Transparent Tribe’s tooling evolution as the Windows family used in parallel with later Linux-focused families such as Poseidon, AresRAT, and DeskRAT. High-confidence infrastructure and campaign details directly tied to CrimsonRAT in the content include student-themed domains such as studentsportal[.]live, studentsportal[.]website, and studentsportal[.]co; additional cloud/media-themed domains cloud-drive[.]store, user-onedrive[.]live, and drive-phone[.]online; subdomains under geo-news[.]tv including cloud-drive.geo-news.tv, drive-phone.geo-news.tv, studentsportal.geo-news.tv, and user-onedrive.geo-news.tv; shared IP 198[.]37[.]123[.]126; and related hosting/name-service links involving vebhost[.]com and zainhosting[.]net.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Quick Heal’s team has identified hacker group APT36 (Transparent Tribe) deploying CrimsonRAT malware through sophisticated phishing attacks along with an RMM tool known as MeshAgent, he said.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesQuick Heal’s team has identified hacker group APT36 (Transparent Tribe) deploying CrimsonRAT malware through sophisticated phishing attacks along with an RMM tool known as MeshAgent, he said.
The current lure is themed as Ministry of Defence procurement of indigenous trawl assemblies for T-72 and T-90 main battle tanks ... a plausible-enough artifact for a defense-contracting inbox to open without hesitation.
Stealth
1 techniqueThe current lure is themed as Ministry of Defence procurement of indigenous trawl assemblies for T-72 and T-90 main battle tanks — a plausible-enough artifact for a defense-contracting inbox to open without hesitation.
Command and Control
1 techniqueQuick Heal’s team has identified hacker group APT36 (Transparent Tribe) deploying CrimsonRAT malware through sophisticated phishing attacks along with an RMM tool known as MeshAgent, he said.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan deployed by APT36 via sophisticated phishing attacks.
A Windows RAT used by APT36 in parallel with its Linux malware development and delivered through lure documents such as xlam, ppam, and docm files.
A Windows .NET-based remote access trojan/implant used to establish long-term access and perform espionage functions. Capabilities described include file/directory listing, process execution, screenshot capture, keylogger log upload, system reconnaissance, arbitrary command execution, file read/write/exfiltration, drive enumeration, and downloading additional USB-worm and keylogger modules from C2.
CrimsonRAT is a remote access trojan used in campaigns targeting South Asia, often linked to the Transparent Tribe APT group. It shares delivery mechanisms with ObliqueRAT, particularly the use of malicious Office documents.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.