Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Pakistan-linked APT group, Transparent Tribe (APT36), is targeting Indian Government and Defense personnel using 'Pahalgam Terror Attack' themed documents. The campaign involves credential phishing and deployment of malicious payloads, with fake domains impersonating Jammu & Kashmir Police and Indian Air Force. The phishing PDF documents contain embedded links leading to fake login pages. A PowerPoint add-on file with malicious macros has been identified, which drops the Crimson RAT payload. The campaign exploits sensitive geopolitical issues to maximize impact and extract intelligence. Multiple phishing domains were created shortly after the attack, impersonating various Indian government entities. The potential impact includes disruption of sensitive operations, information manipulation, and data breaches.

The threat involves a targeted cyber espionage campaign conducted by the Pakistan-linked Advanced Persistent Threat (APT) group known as Transparent Tribe or APT36. This campaign specifically targets Indian Government and Defense personnel by leveraging geopolitical tensions surrounding the Pahalgam terror attack. The attackers employ social engineering techniques, primarily credential phishing, using decoy documents themed around the Pahalgam attack to lure victims. These documents include phishing PDFs embedding links that redirect to counterfeit login portals impersonating official Indian government entities such as the Jammu & Kashmir Police and the Indian Air Force. Additionally, malicious PowerPoint add-on files containing macros are used to deploy the Crimson Remote Access Trojan (RAT), a sophisticated malware capable of persistent access and data exfiltration. The campaign uses multiple fake domains created shortly after the real-world attack to increase credibility and maximize victim engagement. The attack chain involves several tactics and techniques, including spear-phishing (T1566.001), use of malicious macros (T1204.001), credential harvesting (T1113), reconnaissance (T1083, T1082), and establishing persistence (T1547.001). The Crimson RAT payload allows attackers to manipulate information, disrupt sensitive operations, and exfiltrate confidential data, posing significant risks to national security and intelligence confidentiality. While no known exploits are reported in the wild beyond this campaign, the sophistication and targeted nature of the attack highlight the advanced capabilities of APT36 and their focus on exploiting geopolitical events for intelligence gathering.

Detailed information about Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government. Get real-time updates, technical details, and 

Title	Severity	Type	Source	Date

Threats Tagged 'pahalgam attack'

Filter Threats

Threats Tagged 'pahalgam attack'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility