ETDA ThaiCERT
Report
Search
Home > List all groups > Transparent Tribe, APT 36

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Transparent Tribe, APT 36

NamesTransparent Tribe (Proofpoint)
APT 36 (Mandiant)
ProjectM (Palo Alto)
Mythic Leopard (CrowdStrike)
TEMP.Lapis (FireEye)
CountryPakistan Pakistan
MotivationInformation theft and espionage
First seen2013
Description(Proofpoint) Proofpoint researchers recently uncovered evidence of an advanced persistent threat (APT) against Indian diplomatic and military resources. Our investigation began with malicious emails sent to Indian embassies in Saudi Arabia and Kazakstan but turned up connections to watering hole sites focused on Indian military personnel and designed to drop a remote access Trojan (RAT) with a variety of data exfiltration functions. Our analysis shows that many of the campaigns and attacks appear related by common IOCs, vectors, payloads, and language, but the exact nature and attribution associated with this APT remain under investigation.
At this time, the background and analysis in this paper provide useful forensics and detail our current thinking on the malware that we have dubbed “MSIL/Crimson”.

Transparent Tribe may be related to Gorgon Group.

Transparant Tribe has been observed to use the Andromeda botnet (operated by Andromeda Spider).
ObservedSectors: Defense, Embassies, Government.
Countries: Afghanistan, Australia, Austria, Azerbaijan, Belgium, Botswana, Bulgaria, Canada, China, Czech, Germany, India, Iran, Japan, Kazakhstan, Kenya, Malaysia, Mongolia, Nepal, Netherlands, Oman, Pakistan, Romania, Saudi Arabia, Spain, Sweden, Thailand, Turkey, UAE, UK, USA.
Tools usedAndroid RAT, beendoor, Bezigate, Bozok, BreachRAT, Crimson RAT, DarkComet, Luminosity RAT, njRAT, ObliqueRAT, Peppy RAT, SilentCMD, Stealth Mango, UPDATESEE, USBWorm.
Operations performed2012Operation “Transparent Tribe”
On February 11, 2016, we discovered two attacks minutes apart directed towards officials at Indian embassies in both Saudi Arabia and Kazakhstan. Both e-mails (Fig. 1, 2) were sent from the same originating IP address (5.189.145[.]248) belonging to Contabo GmbH, a hosting provider that seems to be currently favored by these threat actors. The e-mails also likely utilized Rackspace’s MailGun service and both of them were carrying the same exact attachment.
<https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf>
Mar 2016Indian TV station CNN-IBN has discovered that Pakistani officials were collecting data about Indian troop movements using an Android app called SmeshApp.
<https://news.softpedia.com/news/smeshapp-removed-from-play-store-because-pakistan-used-it-to-spy-on-indian-army-501936.shtml>
Mar 2016Operation “C-Major”
Trend Micro is reporting on a third campaign, which they’ve named Operation C-Major. According to the security firm, this campaign targeted Indian military officials via spear-phishing emails, distributing spyware to its victims via an Adobe Reader vulnerability.
<https://news.softpedia.com/news/another-case-of-a-pakistani-apt-spying-on-indian-military-personnel-502093.shtml>
<https://blog.trendmicro.com/trendlabs-security-intelligence/operation-c-major-actors-also-used-android-blackberry-mobile-spyware-targets/>
Feb 2017This blog post describes another attack campaign where attackers impersonated identity of Indian think tank IDSA (Institute for Defence Studies and Analyses) and sent out spear-phishing emails to target officials of the Central Bureau of Investigation (CBI) and possibly the officials of Indian Army.
<https://cysinfo.com/cyber-attack-targeting-cbi-and-possibly-indian-army-officials/>
Early 2019Operation “SideCopy”
This cyber-operation has been only targeting Indian defence forces and armed forces personnel.
<https://www.seqrite.com/blog/operation-sidecopy/>
Jun 2019Over the past year, we have seen this group undergo an evolution, stepping up its activities, starting massive infection campaigns, developing new tools and strengthening their focus on Afghanistan.
<https://securelist.com/transparent-tribe-part-1/98127/>
<https://securelist.com/transparent-tribe-part-2/98233/>
Jan 2020Transparent tribe is back with a new campaign after several years of (apparently) inactivity. We can confirm that this campaign is completely new, relying on the registration record of the C2 that dates back to 29 January 2020.
<https://blog.yoroi.company/research/transparent-tribe-four-years-later/>
Early 2020TransparentTribe started using a new module named USBWorm at the beginning of 2020, as well as improving its custom .NET tool named CrimsonRAT.
<https://securelist.com/apt-trends-report-q1-2020/96826/>
Mar 2020APT36 spreads fake coronavirus health advisory
<https://blog.malwarebytes.com/threat-analysis/2020/03/apt36-jumps-on-the-coronavirus-bandwagon-delivers-crimson-rat/>
Apr 2020Operation “Honey Trap”
APT36 Targets Defense Organizations in India
<https://www.seqrite.com/blog/operation-honey-trap-apt36-targets-defense-organizations-in-india/>
Information<https://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html>
<https://www.crowdstrike.com/blog/adversary-of-the-month-for-may/>

Last change to this card: 19 October 2020

Download this actor card in PDF or JSON format

Previous: Tortoiseshell, Imperial Kitten
Next: Tropic Trooper, Pirate Panda, APT 23, KeyBoy

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key