{ "id": "7f94f4fe-e25a-4ed5-95ff-5bd28f17ee74", "created_at": "2026-04-06T00:14:38.026212Z", "updated_at": "2026-04-10T13:11:39.446875Z", "deleted_at": null, "sha1_hash": "421f0e66cc166916d09275a02d172f9d4ebc6ebf", "title": "Operation Armor Piercer - Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 49020, "plain_text": "Operation Armor Piercer - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 21:15:40 UTC\r\nHome \u003e List all groups \u003e Operation Armor Piercer\r\n APT group: Operation Armor Piercer\r\nNames Operation Armor Piercer (Talos)\r\nCountry Pakistan\r\nMotivation Information theft and espionage\r\nFirst seen 2020\r\nDescription\r\n(Talos) Cisco Talos recently discovered a malicious campaign targeting government\r\nemployees and military personnel in the Indian sub-continent with two commercial and\r\ncommodity RAT families known as NetwireRAT (aka NetwireRC) and WarzoneRAT (aka Ave\r\nMaria). The attackers delivered a variety of lures to their targets, predominantly posing as\r\nguides related to Indian governmental infrastructure and operations such as Kavach and I.T.-\r\nrelated guides in the form of malicious Microsoft Office documents (maldocs) and archives\r\n(RARs, ZIPs) containing loaders for the RATs.\r\nSome of these lures and tactics utilized by the attackers bear a strong resemblance to the\r\nTransparent Tribe, APT 36 and SideCopy APT groups, including the use of compromised\r\nwebsites and fake domains.\r\nObserved\r\nSectors: Defense, Government.\r\nCountries: India.\r\nTools used NetWire RC, Warzone RAT.\r\nInformation \u003chttps://blog.talosintelligence.com/2021/09/operation-armor-piercer.html\u003e\r\nLast change to this card: 02 November 2021\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=34414312-e2a7-4c61-85fa-38fdf139bac0\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=34414312-e2a7-4c61-85fa-38fdf139bac0\r\nPage 1 of 1", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/showcard.cgi?u=34414312-e2a7-4c61-85fa-38fdf139bac0" ], "report_names": [ "showcard.cgi?u=34414312-e2a7-4c61-85fa-38fdf139bac0" ], "threat_actors": [ { "id": "187a0668-a968-4cf0-8bfd-4bc97c02f6dc", "created_at": "2022-10-27T08:27:12.955905Z", "updated_at": "2026-04-10T02:00:05.376527Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [ "SideCopy" ], "source_name": "MITRE:SideCopy", "tools": [ "AuTo Stealer", "Action RAT" ], "source_id": "MITRE", "reports": null }, { "id": "fce5181c-7aab-400f-bd03-9db9e791da04", "created_at": "2022-10-25T15:50:23.759799Z", "updated_at": "2026-04-10T02:00:05.3002Z", "deleted_at": null, "main_name": "Transparent Tribe", "aliases": [ "Transparent Tribe", "COPPER FIELDSTONE", "APT36", "Mythic Leopard", "ProjectM" ], "source_name": "MITRE:Transparent Tribe", "tools": [ "DarkComet", "ObliqueRAT", "njRAT", "Peppy" ], "source_id": "MITRE", "reports": null }, { "id": "a4f0e383-f447-4cd6-80e3-ffc073ed4e00", "created_at": "2023-01-06T13:46:39.30167Z", "updated_at": "2026-04-10T02:00:03.280161Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [], "source_name": "MISPGALAXY:SideCopy", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b01b0683-5c7c-4070-ba0c-4fdede370995", "created_at": "2022-10-25T16:07:23.925692Z", "updated_at": "2026-04-10T02:00:04.79318Z", "deleted_at": null, "main_name": "Operation Armor Piercer", "aliases": [], "source_name": "ETDA:Operation Armor Piercer", "tools": [ "NetWeird", "NetWire", "NetWire RAT", "NetWire RC", "NetWired RC", "Recam", "Warzone", "Warzone RAT" ], "source_id": "ETDA", "reports": null }, { "id": "b584b10a-7d54-4d05-9e21-b223563df7b8", "created_at": "2022-10-25T16:07:24.181589Z", "updated_at": "2026-04-10T02:00:04.892659Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [ "G1008", "Mocking Draco", "TAG-140", "UNC2269", "White Dev 55" ], "source_name": "ETDA:SideCopy", "tools": [ "ActionRAT", "AllaKore", "Allakore RAT", "AresRAT", "Bladabindi", "CetaRAT", "DetaRAT", "EpicenterRAT", "Jorik", "Lilith", "Lilith RAT", "MargulasRAT", "ReverseRAT", "njRAT" ], "source_id": "ETDA", "reports": null }, { "id": "abb24b7b-6baa-4070-9a2b-aa59091097d1", "created_at": "2022-10-25T16:07:24.339942Z", "updated_at": "2026-04-10T02:00:04.944806Z", "deleted_at": null, "main_name": "Transparent Tribe", "aliases": [ "APT 36", "APT-C-56", "Copper Fieldstone", "Earth Karkaddan", "G0134", "Green Havildar", "Mythic Leopard", "Opaque Draco", "Operation C-Major", "Operation Honey Trap", "Operation Transparent Tribe", "ProjectM", "STEPPY-KAVACH", "Storm-0156", "TEMP.Lapis", "Transparent Tribe" ], "source_name": "ETDA:Transparent Tribe", "tools": [ "Amphibeon", "Android RAT", "Bezigate", "Bladabindi", "Bozok", "Bozok RAT", "BreachRAT", "Breut", "CapraRAT", "CinaRAT", "Crimson RAT", "DarkComet", "DarkKomet", "ElizaRAT", "FYNLOS", "Fynloski", "Jorik", "Krademok", "Limepad", "Luminosity RAT", "LuminosityLink", "MSIL", "MSIL/Crimson", "Mobzsar", "MumbaiDown", "Oblique RAT", "ObliqueRAT", "Peppy RAT", "Peppy Trojan", "Quasar RAT", "QuasarRAT", "SEEDOOR", "Scarimson", "SilentCMD", "Stealth Mango", "UPDATESEE", "USBWorm", "Waizsar RAT", "Yggdrasil", "beendoor", "klovbot", "njRAT" ], "source_id": "ETDA", "reports": null }, { "id": "c68fa27f-e8d9-4932-856b-467ccfe39997", "created_at": "2023-01-06T13:46:38.450585Z", "updated_at": "2026-04-10T02:00:02.980334Z", "deleted_at": null, "main_name": "Operation C-Major", "aliases": [ "APT36", "APT 36", "TMP.Lapis", "COPPER FIELDSTONE", "Storm-0156", "Transparent Tribe", "ProjectM", "Green Havildar", "Earth Karkaddan", "C-Major", "Mythic Leopard" ], "source_name": "MISPGALAXY:Operation C-Major", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434478, "ts_updated_at": 1775826699, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/421f0e66cc166916d09275a02d172f9d4ebc6ebf.pdf", "text": "https://archive.orkl.eu/421f0e66cc166916d09275a02d172f9d4ebc6ebf.txt", "img": "https://archive.orkl.eu/421f0e66cc166916d09275a02d172f9d4ebc6ebf.jpg" } }