Loading story…
ESET reported that Transparent Tribe (also tracked as APT36) ran an Android espionage campaign that used trojanized messaging apps, MeetsApp and MeetUp, to infect people in India and Pakistan who likely had military or political relevance. The operation appears to have relied on honey-trap romance lures, directing targets to fake download sites instead of Google Play, while the apps retained normal chat features to avoid suspicion and covertly installed the CapraRAT backdoor.
Once installed, the malware enabled broad surveillance, including screenshots, photo capture, audio and call recording, SMS access, contact theft, file exfiltration, and location tracking. ESET linked the activity to Transparent Tribe through reused CapraRAT code, shared command-and-control infrastructure, the same signing certificate, and overlap with domains previously tied to the group; researchers also said poor operator security exposed victim data, allowing them to identify more than 150 victims across India, Pakistan, Russia, Oman, and Egypt.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
On March 7, 2023, ESET published findings on an active Transparent Tribe espionage campaign involving trojanized Android messaging apps that retained chat features while adding spyware capabilities such as screenshot capture, audio recording, SMS access, contact theft, file exfiltration, and location tracking. ESET linked the activity to Transparent Tribe through shared infrastructure, reused CapraRAT code, the same C2 server and signing certificate, and said poor operator security exposed victim PII from more than 150 victims across several countries.
ESET reported that a Transparent Tribe (APT36) campaign using trojanized Android apps named MeetsApp and MeetUp to deliver the CapraRAT backdoor appears to have been active since at least July 2022. The operation likely used romance-scam-style lures and fake distribution websites to target people in India and Pakistan with likely military or political relevance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelOne reported that suspected Pakistan-aligned threat actor **Transparent Tribe** (also tracked as **APT36** and **Operation C-Major**) deployed four new Android `CapraRAT` samples disguised as entertainment apps targeting mobile gamers, weapons enthusiasts, and TikTok users. The malicious APKs masqueraded as apps including **TikTok**, **Weapons**, **Crazy Game**, and **Sexy Videos**, using `WebView` to display legitimate-looking YouTube or `CrazyGames[.]com` content while requesting extensive high-risk permissions unrelated to their advertised purpose. The spyware’s core functionality remained consistent with earlier `CapraTube` activity, but the code was updated to improve compatibility across older Android releases and newer versions including **Android 13** and **Android 14**. Once installed, `CapraRAT` could collect **SMS messages, contacts, call logs, audio recordings, photos, files, and screen or camera data**, then exfiltrate the information to infrastructure tied to the group. SentinelOne said all analyzed APKs used the same `CapraRAT` version identifier and shared command-and-control details including `shareboxs[.]net`, fallback IP `173[.]249[.]50[.]243`, and TCP port `18582`.
Jun 29, 2026
**Transparent Tribe (APT36)**, a Pakistan-aligned threat actor historically associated with espionage against Indian government, defense, and education targets, has been observed expanding operations into **India’s startup ecosystem**, with a particular focus on startups connected to **cybersecurity, intelligence, and law-enforcement support**. Researchers reported the activity after identifying suspicious, India-origin uploads and startup-themed lure material, including the apparent use of personal details tied to a real startup founder to increase the credibility of spear-phishing content. The intrusion chain described relies on **spear-phishing emails** delivering an **ISO container** (e.g., `MeetBisht.iso`) that includes a **malicious LNK shortcut** masquerading as a legitimate document (such as an Excel file) plus a hidden folder containing a **decoy document**, a **batch script** to execute/maintain the infection flow, and the **Crimson RAT** payload (disguised as an executable named like *Excel*). Once installed, **Crimson RAT** enables broad surveillance and control capabilities (e.g., screen monitoring, audio recording, file theft, and system control), aligning with APT36’s established intelligence-collection objectives even as targeting broadens to startup-linked individuals with proximity to sensitive government or security operations.
Jun 29, 2026
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using `mshta.exe`, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions. Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Jun 29, 2026