Threats Tagged 'apt36'

SideCopy, also tracked as APT36 or Transparent Tribe, has launched a new attack campaign targeting Indian defense personnel using a fake 'Minutes Of Meeting' document as lure. The attack employs an identical playbook to previous operations: a double-extension Minutes Of Meeting.docx.lnk file executes a PowerShell stager (pdfdocs.bat) from a nested pdfdocs folder while displaying a clean decoy document. The chain deploys a Remote Access Trojan (pdfdocs) that establishes persistence through the HKCU Run key. The staged components demonstrate low detection rates at initial delivery, with the decoy document scoring 0/66, the stager 1/61, and only the final executable reaching 35/71 detections.

MediumMalwareBritish Indian Ocean TerritoryIndia#rat#indian defense targeting#double extension

SideCopy APT, a Pakistan-linked threat group under the Transparent Tribe umbrella, executed a targeted spear phishing campaign against Afghanistan's Ministry of Finance and provincial revenue directorates. The attack begins with a Pashto-language LNK file disguised as a staff directory document, which executes mshta.exe to fetch remote HTA payloads from compromised Afghan education infrastructure. The multi-stage chain deploys obfuscated JavaScript, establishes registry-based persistence mimicking Microsoft Edge, and ultimately delivers XenoRAT 1.8.7 beaconing to bulletproof Bulgarian hosting. The campaign demonstrates precise knowledge of target administrative context, using Dari and Pashto decoy documents listing provincial finance officials with direct contact information. Infrastructure analysis reveals deliberate staging within Afghan government IP space and C2 infrastructure overlapping with previous SideCopy operations.

MediumMalwareAfghanistan#sidecopy#xenorat#transparent tribe

Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.

MediumMalwareUnited KingdomGermanyFrance+4#apt36#cybersecurity#india

A sophisticated phishing campaign targeting Indian organizations has been uncovered, utilizing spear-phishing techniques reminiscent of Operation Sindoor. The campaign employs a Linux-focused infection method using weaponized .desktop files, a tactic previously associated with APT36. When executed, these files initiate a complex, obfuscated chain that ultimately delivers a MeshAgent payload, granting the attacker full remote access to the compromised system. The campaign showcases an evolution in regional threat actor tactics, particularly in targeting Linux environments. By combining localized spear-phishing lures with advanced obfuscation techniques, the adversaries increase their chances of bypassing defenses and gaining footholds in sensitive networks. The attack chain involves multiple stages of encryption and decryption, anti-VM checks, and the use of legitimate remote administration tools to complicate detection and response efforts.

MediumMalwareUnited KingdomGermanyFrance+2#obfuscation#linux#apt36

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

MediumCampaignNetherlandsGermanyFrance+3#apt36#icon data#ctfuft

APT36, a Pakistan-based threat actor, has launched a sophisticated cyber-espionage campaign targeting the Indian defense sector. The group has adapted its tactics to focus on Linux-based environments, particularly BOSS Linux, used by Indian government agencies. The attack involves phishing emails with a ZIP file containing a malicious .desktop file. When executed, it downloads a legitimate PowerPoint file as a decoy while simultaneously deploying a malicious ELF binary. This multi-stage approach aims to bypass user suspicion and evade traditional security measures. The campaign signifies an advancement in APT36's capabilities and poses an increased risk to critical government and defense infrastructure. Organizations using Linux-based systems are advised to implement robust cybersecurity controls and threat detection mechanisms to mitigate potential risks.

MediumCampaignUnited KingdomGermanyFrance+4#transparent tribe#.desktop file#cyber-espionage

This analysis explores the infrastructure of APT36, also known as Transparent Tribe, using passive DNS and host response history. Starting with indicators from a CyberXTron report on a targeted phishing attack against Indian Government and Defense, the investigation expands through DNS history, IP pivoting, and host response analysis. Key findings include shared name server patterns, non-Cloudflare IP addresses, and connections to previously unreported domains. The research identifies potential new infrastructure using ETag pivoting, revealing domains with similar subdomain conventions to known Transparent Tribe assets. The methodology demonstrates the power of comprehensive DNS data and host response history in uncovering hidden connections and potential threat infrastructure.

MediumCampaignUnited KingdomGermanyFrance+5#defense#passive dns#indian government

Operation Sindoor, a coordinated cyber campaign targeting India's critical sectors, involved state-sponsored APT activity and hacktivist operations. The attack utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, employed advanced tactics including the Ares RAT for persistent access. The campaign targeted defense, government IT, healthcare, telecom, and education sectors. Multiple hacktivist groups participated in DDoS attacks and defacements. The operation showcased a convergence of cyber espionage and ideological warfare, significantly impacting national cybersecurity and trust. It underscored the need for enhanced threat intelligence and robust incident response frameworks to counter evolving hybrid threats.

MediumMalwareUnited KingdomGermanyFrance+2#spear phishing#crimson rat#india

In May 2025, Pakistan-linked hacktivist groups claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites. However, an investigation reveals most breaches were exaggerated or fake. Alleged data leaks contained primarily public information, website defacements left no real impact, and DDoS attacks caused minimal disruption. The more significant threat came from APT36, which used Crimson RAT malware to target Indian defense networks following the Pahalgam terror attack. The malware, delivered through phishing emails with malicious attachments, allows remote execution of commands and data exfiltration. While hacktivist claims generated alarming headlines, the actual impact was limited, with most targeted websites operating normally.

MediumMalwareGermanyFranceItaly+4#ddos#india#apt36