Loading story…
Transparent Tribe (APT36), a Pakistan-aligned threat actor historically associated with espionage against Indian government, defense, and education targets, has been observed expanding operations into India’s startup ecosystem, with a particular focus on startups connected to cybersecurity, intelligence, and law-enforcement support. Researchers reported the activity after identifying suspicious, India-origin uploads and startup-themed lure material, including the apparent use of personal details tied to a real startup founder to increase the credibility of spear-phishing content.
The intrusion chain described relies on spear-phishing emails delivering an ISO container (e.g., MeetBisht.iso) that includes a malicious LNK shortcut masquerading as a legitimate document (such as an Excel file) plus a hidden folder containing a decoy document, a batch script to execute/maintain the infection flow, and the Crimson RAT payload (disguised as an executable named like Excel). Once installed, Crimson RAT enables broad surveillance and control capabilities (e.g., screen monitoring, audio recording, file theft, and system control), aligning with APT36’s established intelligence-collection objectives even as targeting broadens to startup-linked individuals with proximity to sensitive government or security operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Acronis researchers disclosed technical details of the Transparent Tribe campaign, including its use of ISO container attachments, trusted user-directory execution, decoy documents, custom TCP command-and-control communications, and evasion techniques such as junk-data padding and randomized function names. The reporting highlighted Crimson RAT's surveillance and theft capabilities against targeted Indian startups.
Pakistan-linked Transparent Tribe (APT36) shifted its targeting from Indian government and defense organizations to India's technology startup sector, with particular interest in cybersecurity and intelligence-related firms. The campaign used spearphishing emails with ISO attachments to deliver Crimson RAT through a multi-stage infection chain involving malicious LNK, batch, and PowerShell components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using `mshta.exe`, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions. Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Jun 29, 2026
Transparent Tribe (`APT36`), a suspected Pakistan-aligned threat actor, targeted India’s education sector with malicious Microsoft Office documents designed to deliver **Crimson RAT**. Researchers said the campaign used both traditional macro-enabled files and a newer `OLE` embedding technique that tricks victims into double-clicking a fake **"View Document"** prompt, launching the malware under the filename `MicrosoftUpdate.exe`. SentinelOne identified multiple **Crimson RAT** `.NET` variants compiled between July and September 2022 that used the command-and-control domain `richa-sharma.ddns[.]net`. The samples showed anti-analysis delays, persistence checks, and differing obfuscation approaches, including **Eazfuscator**, indicating continued tool refinement as the group broadened its targeting beyond Indian military and government entities to include educational institutions and students across the subcontinent.
Jul 12, 2026
Pakistan-linked threat actor Transparent Tribe (APT36) has launched a targeted cyberespionage campaign against Indian government organizations, focusing on systems running the Bharat Operating System Solutions (BOSS) Linux distribution. The attackers used spear-phishing emails containing malicious ZIP archives or links to cloud-hosted files, which, when opened, executed a Bash command sequence to deploy the Golang-based DeskRAT malware. The campaign, observed since June 2025, leverages decoy PDFs related to Indian defense matters and employs multiple Linux-specific persistence mechanisms, including systemd services, cron jobs, autostart directory entries, and modifications to `.bashrc`. DeskRAT establishes command-and-control via WebSockets, enabling remote file browsing, data exfiltration of files under 100 MB, and the ability to upload and execute additional payloads. Notably, the malware incorporates code potentially generated by large language models, accelerating its development and deployment. Researchers highlight that this use of AI tools by attackers is compressing malware development cycles, making detection and response more challenging for defenders. The campaign underscores the evolving sophistication of APT36 and the growing threat to Linux-based government infrastructure in India.
Jun 29, 2026