Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Operation Sindoor, a coordinated cyber campaign targeting critical Indian sectors, involved state-sponsored APT activity and hacktivist operations. The campaign utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, deployed advanced tactics including the Ares RAT for cyber espionage. The operation targeted defense, government IT, healthcare, telecom, and education sectors. Hacktivists conducted parallel disruptive attacks, using DDoS and defacements. The campaign revealed a convergence of cyber espionage and ideological warfare, showcasing the evolution of modern cyber conflicts. It resulted in data exfiltration, service disruptions, and website defacements, significantly impacting India's cybersecurity landscape and public trust.

Operation Sindoor is a sophisticated, multi-faceted cyber campaign primarily targeting critical sectors within India, orchestrated by the Pakistan-aligned Advanced Persistent Threat group APT36 alongside hacktivist collaborators. The campaign combines state-sponsored cyber espionage with hacktivist-driven disruptive activities, reflecting a hybrid warfare approach that merges intelligence gathering with ideological conflict. APT36 employed advanced tactics such as spear phishing to gain initial access, deploying the Ares Remote Access Trojan (RAT) to conduct stealthy cyber espionage operations. The campaign targeted high-value sectors including defense, government IT infrastructure, healthcare, telecommunications, and education, aiming to exfiltrate sensitive data and undermine operational integrity. Concurrently, hacktivist actors executed distributed denial-of-service (DDoS) attacks and website defacements, amplifying disruption and public distrust. The technical execution involved the use of malicious scripts, spear phishing emails (T1566.001), scheduled task abuse (T1053.005), and living-off-the-land binaries (T1218) to evade detection and maintain persistence. The campaign's infrastructure includes multiple malicious domains such as fogomyart.com and nationaldefencebackup.xyz, which serve as command and control or phishing platforms. Although no known exploits in the wild have been reported, the campaign's blend of espionage and hacktivism demonstrates an evolution in cyber conflict tactics, emphasizing both data theft and public disruption. The operation has significantly impacted India's cybersecurity posture and public trust in digital services.

Detailed information about Operation Sindoor – Anatomy of a Digital Siege. Get real-time updates, technical details, and mitigation strategies.

Operation Sindoor – Anatomy of a Digital Siege - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Sindoor – Anatomy of a Digital Siege

APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and track location. The investigation traced the infrastructure, identified key Indicators of Compromise, and uncovered the full extent of this Android surveillance campaign. The threat actor employs social engineering tactics to distribute their Android Remote Access Trojans, with lures crafted to align with the RAT's disguise. The malware's capabilities include targeted surveillance, credential theft, and infrastructure abuse, potentially eroding brand trust in legitimate communication platforms.

The Transparent Tribe, also known as APT36, is a threat actor group that has resurfaced with a new Android malware campaign involving CapraRAT and Crimson RAT. These Remote Access Trojans (RATs) are distributed via social engineering tactics, specifically by impersonating the popular messaging application Viber. The malware is hosted on infrastructure provided by the VPS provider Contabo, which has been identified and traced by security researchers. CapraRAT masquerades as Viber to deceive users into granting extensive permissions, enabling the malware to record calls, read messages, track user location, and steal credentials. This level of access facilitates targeted surveillance and potential infrastructure abuse. The campaign leverages common social engineering techniques (T1566.001 - spearphishing via malicious links, T1204 - user execution) to lure victims into installing the spyware. Once installed, the malware operates stealthily on Android devices, compromising confidentiality and integrity of communications and personal data. The impersonation of a trusted communication platform like Viber also risks eroding user trust in legitimate apps. Indicators of compromise include multiple file hashes associated with the malware samples. While no known exploits in the wild have been reported, the threat actor's use of VPS infrastructure and social engineering indicates a persistent and targeted approach. This campaign highlights the evolving tactics of APT36 in leveraging mobile platforms for espionage and data theft.

Detailed information about The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber. Get real-time updates, technical details, and mitigation

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber - Live Threat Intelligence - Threat Radar | OffSeq.com

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

A Pakistan-linked APT group, Transparent Tribe (APT36), is targeting Indian Government and Defense personnel using 'Pahalgam Terror Attack' themed documents. The campaign involves credential phishing and deployment of malicious payloads, with fake domains impersonating Jammu & Kashmir Police and Indian Air Force. The phishing PDF documents contain embedded links leading to fake login pages. A PowerPoint add-on file with malicious macros has been identified, which drops the Crimson RAT payload. The campaign exploits sensitive geopolitical issues to maximize impact and extract intelligence. Multiple phishing domains were created shortly after the attack, impersonating various Indian government entities. The potential impact includes disruption of sensitive operations, information manipulation, and data breaches.

The threat involves a targeted cyber espionage campaign conducted by the Pakistan-linked Advanced Persistent Threat group APT36, also known as Transparent Tribe. This campaign specifically targets Indian government and defense personnel by leveraging geopolitical tensions surrounding the Pahalgam terror attack. The attackers use social engineering techniques, primarily credential phishing, to lure victims. They distribute phishing emails containing PDF documents themed around the Pahalgam terror attack, which embed links to fake login pages impersonating official Indian government entities such as Jammu & Kashmir Police and the Indian Air Force. Additionally, a malicious PowerPoint add-on file with embedded macros has been identified, which, when executed, drops the Crimson Remote Access Trojan (RAT) payload onto the victim's system. Crimson RAT is known for its capabilities to exfiltrate sensitive data, maintain persistence, and enable remote control of compromised systems. The campaign employs multiple fake domains closely mimicking legitimate Indian government domains to increase the likelihood of successful credential harvesting and malware deployment. The attack chain exploits user interaction (opening documents and enabling macros) and does not require prior authentication to initiate the compromise. The campaign's objectives appear to be intelligence gathering, disruption of sensitive government operations, and potential manipulation or theft of critical data. Although no known exploits are reported in the wild for this campaign, the use of social engineering combined with sophisticated malware makes it a significant threat to targeted entities.

Detailed information about Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government. Get real-time updates, technical details, and 

Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government - Live Threat Intelligence - Threat Radar | OffSeq.com

Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government

Operation Sindoor, a coordinated cyber campaign targeting India's critical sectors, involved state-sponsored APT activity and hacktivist operations. The attack utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, employed advanced tactics including the Ares RAT for persistent access. The campaign targeted defense, government IT, healthcare, telecom, and education sectors. Multiple hacktivist groups participated in DDoS attacks and defacements. The operation showcased a convergence of cyber espionage and ideological warfare, significantly impacting national cybersecurity and trust. It underscored the need for enhanced threat intelligence and robust incident response frameworks to counter evolving hybrid threats.

Operation Sindoor represents a sophisticated, multi-faceted cyber campaign primarily targeting India's critical infrastructure sectors, including defense, government IT, healthcare, telecommunications, and education. The operation is attributed to APT36, a Pakistan-aligned advanced persistent threat group, supported by various hacktivist entities. The campaign employed a combination of spear phishing attacks to gain initial access, deployment of malicious scripts, website defacements, and strategic data leaks to disrupt and undermine targeted organizations. APT36 utilized the Ares Remote Access Trojan (RAT) to establish persistent footholds within victim networks, enabling long-term espionage and data exfiltration. Concurrently, hacktivist groups launched distributed denial-of-service (DDoS) attacks and defacements to amplify disruption and propagate ideological messages. The operation exemplifies a convergence of cyber espionage and hacktivism, leveraging both covert and overt tactics to degrade national cybersecurity posture and erode public trust. Indicators of compromise include multiple malicious domains such as fogomyart.com and operationsindoor2025.in, which were likely used for command and control or hosting malicious payloads. Although no known exploits in the wild have been reported, the campaign's medium severity rating reflects its potential to cause significant operational and reputational damage. The campaign underscores the necessity for enhanced threat intelligence sharing, robust incident response capabilities, and comprehensive defense-in-depth strategies to counter evolving hybrid threats that blend state-sponsored espionage with hacktivist activism.

Detailed information about Operation Sindoor: Anatomy of a High-Stakes Cyber Siege. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'crimson rat'

Filter Threats

Threats Tagged 'crimson rat'