Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In May 2025, Pakistan-linked hacktivist groups claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites. However, an investigation reveals most breaches were exaggerated or fake. Alleged data leaks contained primarily public information, website defacements left no real impact, and DDoS attacks caused minimal disruption. The more significant threat came from APT36, which used Crimson RAT malware to target Indian defense networks following the Pahalgam terror attack. The malware, delivered through phishing emails with malicious attachments, allows remote execution of commands and data exfiltration. While hacktivist claims generated alarming headlines, the actual impact was limited, with most targeted websites operating normally.

In May 2025, a surge of cyberattacks was publicly claimed by Pakistan-linked hacktivist groups targeting Indian government, education, and critical infrastructure websites. These claims included over 100 attacks involving data leaks, website defacements, and distributed denial-of-service (DDoS) attacks. However, detailed investigations revealed that most of these breaches were either exaggerated or entirely fabricated. The alleged data leaks primarily contained publicly available information, defacements caused no lasting operational damage, and DDoS attacks resulted in only brief and minimal disruptions. The more significant and credible threat originated from the advanced persistent threat (APT) group APT36, which deployed the Crimson RAT malware to target Indian defense networks, particularly following the Pahalgam terror attack. Crimson RAT is a remote access trojan that enables attackers to execute commands remotely, maintain persistence, harvest credentials, and exfiltrate sensitive data. The malware was primarily delivered through phishing campaigns involving malicious email attachments, leveraging social engineering tactics rather than exploiting software vulnerabilities. The attack techniques align with MITRE ATT&CK tactics such as T1566.002 (phishing with malicious attachments), T1547.001 (boot or logon autostart execution), T1041 (exfiltration over command and control channels), and T1071.001 (web protocol communication). Indicators of compromise include suspicious domains mimicking official Indian defense and government email infrastructure, suggesting attempts at credential phishing or command and control communication. Despite the media attention on hacktivist claims, the actual operational impact was limited, with most targeted websites remaining functional and no widespread compromise beyond the targeted defense networks. No known exploits in the wild or patches are currently associated with this threat, and the attack vector relies heavily on social engineering rather than software vulnerabilities. This campaign highlights the tactical use of cyber operations by nation-state affiliated groups to conduct espionage and targeted intrusions rather than broad disruptive campaigns.

Detailed information about Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge. Get real-time updates, technical det

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge - Live Threat Intelligence - Threat Radar | OffSeq.com

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge

Operation Sindoor, a coordinated cyber campaign targeting critical Indian sectors, involved state-sponsored APT activity and hacktivist operations. The campaign utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, deployed advanced tactics including the Ares RAT for cyber espionage. The operation targeted defense, government IT, healthcare, telecom, and education sectors. Hacktivists conducted parallel disruptive attacks, using DDoS and defacements. The campaign revealed a convergence of cyber espionage and ideological warfare, showcasing the evolution of modern cyber conflicts. It resulted in data exfiltration, service disruptions, and website defacements, significantly impacting India's cybersecurity landscape and public trust.

Operation Sindoor is a sophisticated, multi-faceted cyber campaign primarily targeting critical sectors within India, orchestrated by the Pakistan-aligned Advanced Persistent Threat (APT) group APT36 in conjunction with hacktivist collaborators. This campaign represents a hybrid warfare approach, combining state-sponsored cyber espionage with hacktivist-driven disruptive activities. The initial access vector predominantly involved spear phishing (MITRE ATT&CK T1566.001), leveraging targeted emails to infiltrate high-value organizations. Once inside, APT36 deployed the Ares Remote Access Trojan (RAT), a stealthy malware tool designed for persistent cyber espionage, enabling data exfiltration and covert surveillance. The campaign also utilized living-off-the-land binaries (T1218) and scheduled task abuse (T1053.005) to evade detection and maintain persistence within compromised environments. Parallel to espionage efforts, hacktivist actors conducted disruptive operations including distributed denial-of-service (DDoS) attacks and website defacements, amplifying operational impact and undermining public trust. The targeted sectors—defense, government IT, healthcare, telecommunications, and education—are critical to national security and public welfare, highlighting the strategic intent behind the campaign. The infrastructure supporting the operation includes multiple malicious domains such as fogomyart.com and nationaldefencebackup.xyz, which serve as command and control servers or phishing platforms. Although no known exploits in the wild have been reported, the campaign’s blend of espionage and hacktivism illustrates an evolution in cyber conflict tactics, emphasizing both intelligence gathering and public disruption. This operation has significantly impacted India’s cybersecurity posture and eroded public confidence in digital services.

Detailed information about Operation Sindoor – Anatomy of a Digital Siege. Get real-time updates, technical details, and mitigation strategies.

Operation Sindoor – Anatomy of a Digital Siege - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Sindoor – Anatomy of a Digital Siege

APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and track location. The investigation traced the infrastructure, identified key Indicators of Compromise, and uncovered the full extent of this Android surveillance campaign. The threat actor employs social engineering tactics to distribute their Android Remote Access Trojans, with lures crafted to align with the RAT's disguise. The malware's capabilities include targeted surveillance, credential theft, and infrastructure abuse, potentially eroding brand trust in legitimate communication platforms.

APT36, also known as Transparent Tribe, has re-emerged with a sophisticated Android malware campaign involving two Remote Access Trojans (RATs): CapraRAT and Crimson RAT. The threat actor leverages social engineering techniques to distribute these RATs by impersonating the popular messaging application Viber. This impersonation is designed to deceive users into installing the spyware, which requests extensive permissions on Android devices. Once granted, the malware can record calls, read messages, track user location, and steal credentials, enabling comprehensive surveillance and espionage capabilities. The malicious infrastructure supporting this campaign is hosted on VPS services provided by Contabo, complicating takedown efforts due to the legitimate nature of the hosting provider. The campaign uses spearphishing via malicious links (MITRE ATT&CK T1566.001) and user execution (T1204) tactics to lure victims. Indicators of compromise include multiple file hashes associated with the malware samples, which can be used for detection and blocking. Although no known exploits in the wild have been reported, the persistent and targeted nature of this campaign highlights the evolving tactics of APT36 in exploiting mobile platforms for espionage and data theft. The impersonation of a trusted communication platform like Viber also risks eroding user trust in legitimate apps, potentially impacting broader communication security ecosystems.

Detailed information about The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber. Get real-time updates, technical details, and mitigation

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber - Live Threat Intelligence - Threat Radar | OffSeq.com

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

A Pakistan-linked APT group, Transparent Tribe (APT36), is targeting Indian Government and Defense personnel using 'Pahalgam Terror Attack' themed documents. The campaign involves credential phishing and deployment of malicious payloads, with fake domains impersonating Jammu & Kashmir Police and Indian Air Force. The phishing PDF documents contain embedded links leading to fake login pages. A PowerPoint add-on file with malicious macros has been identified, which drops the Crimson RAT payload. The campaign exploits sensitive geopolitical issues to maximize impact and extract intelligence. Multiple phishing domains were created shortly after the attack, impersonating various Indian government entities. The potential impact includes disruption of sensitive operations, information manipulation, and data breaches.

The threat involves a targeted cyber espionage campaign conducted by the Pakistan-linked Advanced Persistent Threat (APT) group known as Transparent Tribe or APT36. This campaign specifically targets Indian Government and Defense personnel by leveraging geopolitical tensions surrounding the Pahalgam terror attack. The attackers employ social engineering techniques, primarily credential phishing, using decoy documents themed around the Pahalgam attack to lure victims. These documents include phishing PDFs embedding links that redirect to counterfeit login portals impersonating official Indian government entities such as the Jammu & Kashmir Police and the Indian Air Force. Additionally, malicious PowerPoint add-on files containing macros are used to deploy the Crimson Remote Access Trojan (RAT), a sophisticated malware capable of persistent access and data exfiltration. The campaign uses multiple fake domains created shortly after the real-world attack to increase credibility and maximize victim engagement. The attack chain involves several tactics and techniques, including spear-phishing (T1566.001), use of malicious macros (T1204.001), credential harvesting (T1113), reconnaissance (T1083, T1082), and establishing persistence (T1547.001). The Crimson RAT payload allows attackers to manipulate information, disrupt sensitive operations, and exfiltrate confidential data, posing significant risks to national security and intelligence confidentiality. While no known exploits are reported in the wild beyond this campaign, the sophistication and targeted nature of the attack highlight the advanced capabilities of APT36 and their focus on exploiting geopolitical events for intelligence gathering.

Detailed information about Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government. Get real-time updates, technical details, and 

Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government - Live Threat Intelligence - Threat Radar | OffSeq.com

Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government

Operation Sindoor, a coordinated cyber campaign targeting India's critical sectors, involved state-sponsored APT activity and hacktivist operations. The attack utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, employed advanced tactics including the Ares RAT for persistent access. The campaign targeted defense, government IT, healthcare, telecom, and education sectors. Multiple hacktivist groups participated in DDoS attacks and defacements. The operation showcased a convergence of cyber espionage and ideological warfare, significantly impacting national cybersecurity and trust. It underscored the need for enhanced threat intelligence and robust incident response frameworks to counter evolving hybrid threats.

Operation Sindoor is a sophisticated and coordinated cyber campaign primarily targeting critical sectors within India, including defense, government IT, healthcare, telecommunications, and education. The operation is attributed to APT36, a Pakistan-aligned advanced persistent threat group, which employed advanced tactics such as spear phishing to gain initial access, deployment of malicious scripts, and the use of the Ares Remote Access Trojan (RAT) to establish persistent footholds within victim networks. This RAT enables long-term espionage and data exfiltration, allowing attackers to maintain control and gather sensitive information over extended periods. Concurrently, multiple hacktivist groups participated in the campaign by conducting distributed denial-of-service (DDoS) attacks and website defacements, amplifying disruption and spreading ideological messages. The campaign represents a hybrid threat model combining covert cyber espionage with overt hacktivist activism, aiming to degrade national cybersecurity posture and erode public trust. Indicators of compromise include several malicious domains such as fogomyart.com and operationsindoor2025.in, likely used for command and control or hosting malicious payloads. Although no known exploits in the wild have been reported, the campaign’s medium severity rating reflects its potential for significant operational and reputational damage. The operation underscores the necessity for enhanced threat intelligence sharing, robust incident response frameworks, and comprehensive defense-in-depth strategies to counter evolving hybrid threats that blend state-sponsored espionage with hacktivist activism.

Detailed information about Operation Sindoor: Anatomy of a High-Stakes Cyber Siege. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'crimson rat'

Filter Threats

Threats Tagged 'crimson rat'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility