(Proofpoint) Proofpoint researchers recently uncovered evidence of an advanced persistent threat (APT) against Indian diplomatic and military resources. Our investigation began with malicious emails sent to Indian embassies in Saudi Arabia and Kazakstan but turned up connections to watering hole sites focused on Indian military personnel and designed to drop a remote access Trojan (RAT) with a variety of data exfiltration functions. Our analysis shows that many of the campaigns and attacks appear related by common IOCs, vectors, payloads, and language, but the exact nature and attribution associated with this APT remain under investigation. At this time, the background and analysis in this paper provide useful forensics and detail our current thinking on the malware that we have dubbed “MSIL/Crimson”. Transparent Tribe may be related to Gorgon Group and SideCopy. Their malicious infrastructure was infiltrated by Turla, Waterbug, Venomous Bear in 2022. Transparant Tribe has been observed to use the Andromeda botnet (operated by Andromeda Spider).
The threat actor SideCopy, originating from Pakistan and linked to the Transparent Tribe cluster, has broadened its targeting beyond Indian government entities to include academic institutions in India. They are utilizin…
The Pakistan-aligned threat group Transparent Tribe (APT36/Earth Karkaddan) is actively targeting government and defense entities in India and Afghanistan with a new campaign, Operation RapidRust. They are utilizing a su…
Pakistan's Transparent Tribe, a known advanced persistent threat (APT) group, has been aggressively targeting organizations in Afghanistan and India, utilizing a refined toolset including the Patchcord backdoor and other…
A Pakistan-aligned threat actor, APT36 (Transparent Tribe), is targeting Afghan telecom providers and critical infrastructure in South Asia with a new backdoor campaign called PATCHCORD. The campaign utilizes sector-spec…
A Pakistani advanced persistent threat (APT) group, identified as SideCopy and linked to the Transparent Tribe (APT 36), has been conducting espionage against Afghanistan's finance ministry since at least May 2025. The g…
