Transparent Tribe, APT 36 - Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 19:22:58 UTC Home > List all groups > Transparent Tribe, APT 36 APT group: Transparent Tribe, APT 36 Names Transparent Tribe (Proofpoint) APT 36 (Mandiant) ProjectM (Palo Alto) Mythic Leopard (CrowdStrike) TEMP.Lapis (FireEye) Copper Fieldstone (SecureWorks) Earth Karkaddan (Trend Micro) STEPPY-KAVACH (Securonix) Green Havildar (PWC) APT-C-56 (Qihoo 360) Storm-0156 (Microsoft) Opaque Draco (Palo Alto) G0134 (MITRE) Country Pakistan Motivation Information theft and espionage First seen 2013 Description (Proofpoint) Proofpoint researchers recently uncovered evidence of an advanced persistent threat (APT) agai Indian diplomatic and military resources. Our investigation began with malicious emails sent to Indian emba in Saudi Arabia and Kazakstan but turned up connections to watering hole sites focused on Indian military personnel and designed to drop a remote access Trojan (RAT) with a variety of data exfiltration functions. Ou analysis shows that many of the campaigns and attacks appear related by common IOCs, vectors, payloads, a language, but the exact nature and attribution associated with this APT remain under investigation. At this time, the background and analysis in this paper provide useful forensics and detail our current thinkin the malware that we have dubbed “MSIL/Crimson”. Transparent Tribe may be related to Gorgon Group and SideCopy. Their malicious infrastructure was infiltrated by Turla, Waterbug, Venomous Bear in 2022. Transparant Tribe has been observed to use the Andromeda botnet (operated by Andromeda Spider). Observed Sectors: Defense, Education, Embassies, Government. Countries: Afghanistan, Australia, Austria, Azerbaijan, Belgium, Botswana, Bulgaria, Canada, China, Czech, Germany, India, Iran, Japan, Kazakhstan, Kenya, Malaysia, Mongolia, Nepal, Netherlands, Oman, Pakistan, Romania, Saudi Arabia, Spain, Sweden, Thailand, Turkey, UAE, UK, USA. https://apt.etda.or.th/cgi-bin/showcard.cgi?u=be967aec-2b55-45f2-86e8-7f22cc66db85 Page 1 of 4 Tools used Amphibeon, Android RAT, beendoor, Bezigate, Bozok, BreachRAT, CapraRAT, Crimson RAT, DarkComet, ElizaRAT, Limepad, Luminosity RAT, Mobzsar, MumbaiDown, njRAT, ObliqueRAT, Peppy RAT, QuasarRA SilentCMD, Stealth Mango, UPDATESEE, USBWorm, Waizsar RAT. Operations performed 2012 Operation “Transparent Tribe” On February 11, 2016, we discovered two attacks minutes apart directed towards officials at I embassies in both Saudi Arabia and Kazakhstan. Both e-mails (Fig. 1, 2) were sent from the s originating IP address (5.189.145[.]248) belonging to Contabo GmbH, a hosting provider that seems to be currently favored by these threat actors. The e-mails also likely utilized Rackspac MailGun service and both of them were carrying the same exact attachment. Mar 2016 Indian TV station CNN-IBN has discovered that Pakistani officials were collecting data about Indian troop movements using an Android app called SmeshApp. Mar 2016 Operation “C-Major” Trend Micro is reporting on a third campaign, which they’ve named Operation C-Major. According to the security firm, this campaign targeted Indian military officials via spear-phish emails, distributing spyware to its victims via an Adobe Reader vulnerability. Feb 2017 This blog post describes another attack campaign where attackers impersonated identity of Ind think tank IDSA (Institute for Defence Studies and Analyses) and sent out spear-phishing ema target officials of the Central Bureau of Investigation (CBI) and possibly the officials of India Army. Jun 2019 Over the past year, we have seen this group undergo an evolution, stepping up its activities, starting massive infection campaigns, developing new tools and strengthening their focus on Afghanistan. Jan 2020 Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal Jan 2020 Transparent tribe is back with a new campaign after several years of (apparently) inactivity. W can confirm that this campaign is completely new, relying on the registration record of the C2 dates back to 29 January 2020. Early 2020 TransparentTribe started using a new module named USBWorm at the beginning of 2020, as w as improving its custom .NET tool named CrimsonRAT. https://apt.etda.or.th/cgi-bin/showcard.cgi?u=be967aec-2b55-45f2-86e8-7f22cc66db85 Page 2 of 4 Mar 2020 APT36 spreads fake coronavirus health advisory Apr 2020 Operation “Honey Trap” APT36 Targets Defense Organizations in India Feb 2021 ObliqueRAT returns with new campaign using hijacked websites Jun 2021 Transparent Tribe campaign uses new bespoke malware to target Indian government officials Dec 2021 Transparent Tribe begins targeting education sector in latest campaign 2022 APT-36 Uses New TTPs and New Tools to Target Indian Governmental Organizations Jul 2022 Love scam or espionage? Transparent Tribe lures Indian and Pakistani officials Jul 2022 Pakistan-Aligned Threat Actor Expands Interest in Indian Education Sector Nov 2022 New STEPPY#KAVACH Attack Campaign Likely Targeting Indian Government: Technical Insights and Detection Using Securonix Apr 2023 Cyber Espionage in India: Decoding APT-36's New Linux Malware Campaign Sep 2023 The Evolution of Transparent Tribe’s New Malware Late 2023 Transparent Tribe Targets Indian Government, Defense, and Aerospace Sectors Leveraging Cr Platform Programming Languages Jun 2024 CapraTube Remix | Transparent Tribe’s Android Spyware Targeting Gamers, Weapons Enthus Mar 2025 APT36-Style ClickFix Attack Spoofs Indian Ministry to Target Windows & Linux https://apt.etda.or.th/cgi-bin/showcard.cgi?u=be967aec-2b55-45f2-86e8-7f22cc66db85 Page 3 of 4 Information MITRE ATT&CK Last change to this card: 16 August 2025 Download this actor card in PDF or JSON format Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=be967aec-2b55-45f2-86e8-7f22cc66db85 https://apt.etda.or.th/cgi-bin/showcard.cgi?u=be967aec-2b55-45f2-86e8-7f22cc66db85 Page 4 of 4