Loading story…
Human rights defenders in India were targeted in a coordinated spearphishing operation that used impersonation lures and links hosted on Firefox Send to deliver NetWire spyware to Windows systems. Amnesty International and Citizen Lab said at least nine activists, lawyers, academics, and a journalist connected to advocacy or legal work around the Bhima Koregaon 11 were targeted between January and October 2019, in what researchers assessed was an unlawful surveillance effort rather than ordinary cybercrime. Technical analysis tied the activity to NetWire payloads communicating with researchplanet.zapto[.]org over port 1810, and the report noted that some of the same individuals had also previously been targeted with Pegasus spyware.
A separate but related campaign described by Cisco Talos showed continued use of NetWireRAT in targeted attacks across the Indian subcontinent, this time aimed at Indian government employees and military personnel. Active since late 2020, the operation used malicious Office documents, archives, compromised websites, and fake domains, with lures themed around Indian government matters such as the Kavach two-factor authentication application; operators also deployed WarzoneRAT, persistence mechanisms, process hollowing, and custom file-enumerator malware. Talos said the tactics and lures resembled activity linked to Transparent Tribe and SideCopy, highlighting sustained use of commercial remote-access malware in espionage-focused campaigns against Indian civil society and state-linked targets.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
In June 2021, the attackers experimented with using Pastebin as a platform to host payloads. Talos documented this as part of the campaign's evolving infrastructure and delivery methods.
In May 2021, the operators used a C# downloader that contacted a decoy URL and only executed malicious logic when the communication failed. This marked a change in the campaign's delivery technique.
During March and April 2021, the attackers used downloader malware that fetched and executed RAT payloads from remote locations. Early variants used RunPE DLLs to inject malware into processes such as InstallUtil.exe.
Cisco Talos said the earliest observed instance of Operation Armor Piercer dated to December 2020, targeting Indian government employees and military personnel. The campaign used malicious Office documents and archives to deliver NetWireRAT and WarzoneRAT.
Amnesty International reported that three of the nine NetWire targets—Shalini Gera, Nihal Singh Rathod, and Degree Prasad Chouhan—were also targeted in 2019 with NSO Group's Pegasus spyware, indicating a broader pattern of surveillance against the same community. The report also noted Pegasus targeting of Anand Teltumbde.
Between January and October 2019, a coordinated spearphishing campaign targeted at least nine human rights defenders in India, including activists, lawyers, academics, and a journalist. The emails attempted to install NetWire spyware on Windows systems using impersonation themes and malicious links.
Cisco Talos disclosed Operation Armor Piercer as an ongoing campaign active since late 2020 that targeted Indian government and military personnel with NetWireRAT and WarzoneRAT. Talos said the lures, themes, and infrastructure resembled activity associated with Transparent Tribe and SideCopy.
Amnesty International and Citizen Lab reported a coordinated spyware operation targeting Indian human rights defenders and linked it to NetWire malware and related infrastructure. The researchers said the activity appeared intended for unlawful surveillance rather than ordinary cybercrime.
FireEye published research on APT33, describing Iranian cyber-espionage activity targeting aerospace and energy organizations and noting ties to destructive malware. The provided reference does not include further dated event details beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 202 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourceamnesty.org
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026
Threat researchers reported multiple spear-phishing campaigns targeting Indian government and military personnel with **COVID-19-themed** and investigation-themed decoy documents delivered through disk image files. In one operation attributed with moderate confidence to **Transparent Tribe**, victims received an `IMG` file containing a benign vaccination PDF, a malicious shortcut, and a `VBS` script that launched **PeppyRAT**, a Python-based Windows payload. The malware gathered host and process information, sent it to command-and-control servers over `HTTP`, and established persistence by placing a .NET loader in the Windows Startup folder to await a second-stage DLL, `mscontainer.dll`, which researchers said may be previously undocumented. A separate campaign aimed at Indian government and local institutions used `ISO` files with `LNK` shortcuts and malicious DLLs that were executed through `rundll32.exe` to load **Cobalt Strike** beacons directly in memory. Researchers said the lures referenced cyberattack investigations and COVID-19 precautions, while the infrastructure included the domain `instade.co.in` and compromised systems tied to `comesa.int`, including `covid.comesa.int`. Analysis of the loader showed XOR-encrypted strings, custom API hashing, PEB walking for API resolution, and `LZNT1`-compressed embedded payloads; the beacons also shared the same public key and watermark, suggesting linked operator infrastructure even though attribution remained unconfirmed.
Aug 15, 2026
Researchers reported that the **SideCopy** espionage group targeted Indian defence organizations and armed forces personnel with spear-phishing campaigns using military-themed and honeytrap lures, including DRDO procurement documents, foreign assignment selections, personal photos, and reports about clashes involving soldiers. Across multiple campaigns, the attackers delivered malicious archives, disguised `LNK` files, and template-injection documents exploiting `CVE-2017-11882`, then used `mshta.exe` to retrieve remote `HTA` payloads, display decoy content, and establish persistence through `VBS` scripts, BAT files, and registry `Run` entries. The intrusion chains deployed several remote-access tools, including **MargulasRAT**, **Action RAT** variants, and a newly observed **.NET-based RAT**, while also abusing the legitimate `credwiz.exe` binary for DLL sideloading. Investigators said the malware exfiltrated files from user directories, collected host information, and communicated with command-and-control infrastructure over ports such as `1443`, `2443`, and `3443`, with some payload URLs hidden behind TinyURL links and others hosted on domains including `elfinindia[.]com`. The activity was tied to SideCopy operations active since 2019 and was assessed as closely aligned with, or possibly a subdivision of, **Transparent Tribe** based on overlapping tradecraft, infrastructure, and targeting.
Aug 15, 2026