Loading story…
APT36 (Transparent Tribe), a Pakistan-linked threat group, has been observed targeting Indian government entities and diplomats with a high-volume wave of AI-generated, low-quality “vibeware” malware, according to Bitdefender research. The activity reflects a shift away from relying solely on established tooling toward rapidly producing disposable implants—often written in less common languages such as Nim, Zig, and Crystal—to increase throughput and potentially reduce detection by traditional antivirus signatures.
While much of the code is described as mediocre and error-prone (including examples of broken data-stealing logic), some capabilities are intrusive. Reported tooling includes LuminousCookies, which attempts to steal browser data by bypassing Chrome/Edge App-Bound Encryption by operating inside the browser’s memory context, and tradecraft intended to mislead attribution (e.g., embedding the common Hindu name “Kumar” in file paths and using culturally themed infrastructure naming such as a Discord server labeled “Jinwoo’s Server”). Bitdefender also assessed the vibeware approach as a “hybrid” fallback alongside known APT36-associated tooling and TTPs, including use of the open-source Havoc C2 framework and a shellcode loader referred to as Warcode, emphasizing scalability over sophistication and not relying on zero-days.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage framed APT36's activity as part of a wider trend of state-aligned actors using generative AI to accelerate malware and phishing development. Reports also cited Iran-aligned MuddyWater's alleged use of Google's Gemini and a Rust backdoor called 'Char,' with emoji-containing artifacts presented as possible evidence of AI-assisted development.
Bitdefender publicly documented APT36's AI-assisted malware production model, describing it as 'vibeware' and characterizing the tactic as a 'Distributed Denial of Detection' approach intended to overwhelm defenders with volume and diversity. The report highlighted unstable code, emoji-laden artifacts, and the use of polyglot malware in languages such as Nim, Zig, Crystal, Rust, Go, and C#.
Analysis of the campaign found APT36 gaining access through phishing, including ZIP/ISO archives with LNK files and resume-themed PDF lures that redirected victims to attacker-controlled downloads. Once inside, the group used in-memory PowerShell, custom loaders, and legitimate services such as Slack, Discord, Google Sheets, Supabase, and Firebase for command-and-control and data exfiltration.
Pakistan-linked APT36 (Transparent Tribe) began using generative AI to mass-produce large volumes of disposable malware aimed at Indian government entities, embassies, and other South Asia targets, with some reporting also noting Afghan government and private-sector victims. The campaign favored scale over sophistication, producing implants in multiple less common languages to reduce detection coverage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcehackread.com
Open sourcebankinfosecurity.com
Open sourcedarkreading.com
Open sourcebusinessinsights.bitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active cyber espionage campaign linked with moderate confidence to **APT36** (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to **Afghan Telecom**, government updates, and software installers. The operation uses a malware cluster that includes **HACKERAI C2 Agent**, **PATCHCORD**, and **SHEETCORD**, showing an evolution from earlier custom C/C++ tooling to newer **Go-based implants**. The malware uses legitimate cloud services as covert command-and-control channels, with **HACKERAI** abusing **GitHub Gists** and **SHEETCORD** using **Google Sheets** for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple `SHA-256` hashes.
Aug 16, 2026
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using `mshta.exe`, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions. Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Jun 29, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026