Loading story…
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using mshta.exe, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions.
Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cyfirma researchers documented the campaign's use of mshta.exe, remote HTA scripts, in-memory .NET RAT loading, decoy documents, and abuse of trusted Windows components for evasion. Reporting also identified malware components and RAT capabilities including remote control, surveillance, data theft, persistence, and clipboard monitoring.
Transparent Tribe (APT36) initiated a spear-phishing campaign targeting Indian government, academic, and other strategic entities using ZIP archives themed around the "Online JLPT Exam Dec 2025." The lures delivered malicious Windows LNK files disguised as PDFs to begin a multi-stage intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Transparent Tribe (APT36)**, a Pakistan-aligned threat actor historically associated with espionage against Indian government, defense, and education targets, has been observed expanding operations into **India’s startup ecosystem**, with a particular focus on startups connected to **cybersecurity, intelligence, and law-enforcement support**. Researchers reported the activity after identifying suspicious, India-origin uploads and startup-themed lure material, including the apparent use of personal details tied to a real startup founder to increase the credibility of spear-phishing content. The intrusion chain described relies on **spear-phishing emails** delivering an **ISO container** (e.g., `MeetBisht.iso`) that includes a **malicious LNK shortcut** masquerading as a legitimate document (such as an Excel file) plus a hidden folder containing a **decoy document**, a **batch script** to execute/maintain the infection flow, and the **Crimson RAT** payload (disguised as an executable named like *Excel*). Once installed, **Crimson RAT** enables broad surveillance and control capabilities (e.g., screen monitoring, audio recording, file theft, and system control), aligning with APT36’s established intelligence-collection objectives even as targeting broadens to startup-linked individuals with proximity to sensitive government or security operations.
Jun 29, 2026
Transparent Tribe (`APT36`), a suspected Pakistan-aligned threat actor, targeted India’s education sector with malicious Microsoft Office documents designed to deliver **Crimson RAT**. Researchers said the campaign used both traditional macro-enabled files and a newer `OLE` embedding technique that tricks victims into double-clicking a fake **"View Document"** prompt, launching the malware under the filename `MicrosoftUpdate.exe`. SentinelOne identified multiple **Crimson RAT** `.NET` variants compiled between July and September 2022 that used the command-and-control domain `richa-sharma.ddns[.]net`. The samples showed anti-analysis delays, persistence checks, and differing obfuscation approaches, including **Eazfuscator**, indicating continued tool refinement as the group broadened its targeting beyond Indian military and government entities to include educational institutions and students across the subcontinent.
Jul 12, 2026
Pakistan-linked threat actor Transparent Tribe (APT36) has launched a targeted cyberespionage campaign against Indian government organizations, focusing on systems running the Bharat Operating System Solutions (BOSS) Linux distribution. The attackers used spear-phishing emails containing malicious ZIP archives or links to cloud-hosted files, which, when opened, executed a Bash command sequence to deploy the Golang-based DeskRAT malware. The campaign, observed since June 2025, leverages decoy PDFs related to Indian defense matters and employs multiple Linux-specific persistence mechanisms, including systemd services, cron jobs, autostart directory entries, and modifications to `.bashrc`. DeskRAT establishes command-and-control via WebSockets, enabling remote file browsing, data exfiltration of files under 100 MB, and the ability to upload and execute additional payloads. Notably, the malware incorporates code potentially generated by large language models, accelerating its development and deployment. Researchers highlight that this use of AI tools by attackers is compressing malware development cycles, making detection and response more challenging for defenders. The campaign underscores the evolving sophistication of APT36 and the growing threat to Linux-based government infrastructure in India.
Jun 29, 2026