Transparent Tribe has spent more than a decade sending convincing lures to Indian military, government and research staff, and its recent tooling hides command traffic inside Slack, Telegram and Google cloud services that most networks allow by default. This profile covers the group MITRE ATT&CK tracks as G0134 Transparent Tribe, also known as APT36, Mythic Leopard, COPPER FIELDSTONE and ProjectM. ATT&CK describes it as a suspected Pakistan-based group active since at least 2013. The page draws on ATT&CK v20 and primary research from Kaspersky, Cisco Talos, Check Point Research and CYFIRMA, using each source's own attribution wording. It is written for SOC analysts, email security teams and IT staff in Indian government, defence, defence suppliers, research bodies and education, and for anyone defending staff with access to those networks. For the wider category, see the Threat Intelligence Guide.
Key takeaways
- The lure is the attack. Talos documented lures built around COVID advisories, CVs, honeytraps, conference agendas and documents posing as Indian Armed Forces material, delivered by email, links and archives.
- Cloud apps carry the commands. Check Point found ElizaRAT variants using Telegram, the Slack API and a Google service account for command and control, so allowed SaaS traffic is the channel to watch.
- Linux is in scope. CYFIRMA reported in August 2025 that the group used Linux .desktop shortcut files disguised as PDFs against BOSS Linux systems in Indian government.
- Removable media is a collection path. Kaspersky's USBWorm and Check Point's later USB stealers copy documents from USB drives, which matters for air-gapped or restricted networks.
- Old controls still stop much of it. Macro-laden Office files, Control Panel (.cpl) files and ZIP or RAR archives with executables are recurring entry points that attachment and execution policy can block.
Who they are (names and aliases)
ATT&CK describes Transparent Tribe as suspected Pakistan-based, primarily targeting diplomatic, defence and research organisations in India and Afghanistan. Check Point Research (2024) describes it as Pakistan-based and focused on Indian government, diplomatic and military targets. CYFIRMA (2025) describes APT36 as Pakistan-based and widely assessed to operate with state sponsorship. Kaspersky has tracked the group since 2013 and calls it highly prolific.
| Name | Used by | Notes |
|---|---|---|
| Transparent Tribe (G0134) | MITRE ATT&CK; Kaspersky; Talos; Check Point | Name from Proofpoint's 2016 "Operation Transparent Tribe" research cited by ATT&CK |
| APT36 | ATT&CK alias; Talos; Check Point; CYFIRMA | Widely used in Indian reporting |
| Mythic Leopard | ATT&CK alias; CrowdStrike naming | Also listed by Kaspersky and Talos |
| COPPER FIELDSTONE | ATT&CK alias; Secureworks naming | Listed in ATT&CK v20 |
| ProjectM | ATT&CK alias; Palo Alto Networks Unit 42 (2016) | Kaspersky lists it as PROJECTM |
This page names no individuals. For a neighbouring South Asian profile, see the Sidewinder Threat Actor Profile Guide.
Malware and tools
| Software | Platform | What ATT&CK and vendors say |
|---|---|---|
| Crimson (S0115) | Windows | The group's staple .NET RAT: file management, screenshots, webcam and microphone capture, keylogging, command execution and browser credential theft (Kaspersky) |
| USBWorm (Crimson component) | Windows | Hides real folders on removable drives, replaces them with copies of itself and steals documents (Kaspersky) |
| ObliqueRAT (S0644) | Windows | Second Windows RAT reported by Talos from 2020, hosted on compromised websites in 2021 |
| Peppy (S0643) | Windows | Python-based RAT (Kaspersky; ATT&CK) |
| ElizaRAT | Windows | .NET RAT first disclosed in September 2023; Check Point assesses it is used exclusively by this group; C2 over Telegram, Slack or Google services |
| njRAT (S0385); DarkComet (S0334) | Windows | Commodity RATs recorded by ATT&CK from early campaigns |
| Linux payloads via .desktop files | Linux | Downloaded payload with autostart, user systemd service and cron persistence (CYFIRMA, 2025) |
Targeting and motivation
- Motivation: espionage against India's defence and government establishment.
- Primary targets: Indian military and government personnel (Kaspersky), defence personnel in the Indian subcontinent (Talos), and Indian government, diplomatic and military bodies (Check Point).
- Wider reach: victims in 27 countries between June 2019 and June 2020, most in India and Afghanistan (Kaspersky); diplomatic entities, defence contractors, research organisations and conference attendees (Talos).
- Targeting checks: Check Point saw samples check for the India Standard Time zone before running.
- Who should care: anyone in Indian public sector, defence supply chain or research, and foreign missions working with them. Personal email and phones of staff are part of the target surface.
Tactics and techniques (MITRE ATT&CK)
IDs are ATT&CK v20 techniques recorded against G0134, grouped by tactic, plus rows marked "NHIMG mapping" where a vendor's description maps to a technique ATT&CK does not yet record for the group.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Resource development | T1583.001 Domains; T1584.001 Domains; T1608.004 Drive-by Target | Look-alike domains for file sharing, government, defence and research sites; compromised legitimate sites hosting payloads | Look-alike domain monitoring; protective DNS |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | Maldocs, archives and links in email | Attachment sandboxing; strip archives with executables |
| Initial access | T1189 Drive-by Compromise | Malicious hyperlinks and iframes on attacker sites | Protective DNS; browser isolation for high-risk staff |
| Execution | T1204.002 Malicious File; T1204.001 Malicious Link; T1059.005 Visual Basic | VBA macros dropping encoded archives; users opening links | Block macros in files from the internet; user reporting |
| Execution | T1203 Exploitation for Client Execution | Old Office flaws CVE-2012-0158 and CVE-2010-3333 in early campaigns | Patch Office; retire unsupported versions |
| Stealth | T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories | Encoded executables; folders mimicked on USB drives with real ones hidden | Show hidden files and extensions; EDR on removable media writes |
| Command and control | T1568 Dynamic Resolution | Dynamic DNS for C2 | Block or alert on dynamic DNS domains |
| Command and control (NHIMG mapping) | T1102 Web Service | Slack API, Telegram and Google service account C2 (Check Point) | SaaS tenant restrictions; alert on API use by non-browser processes |
| Persistence (NHIMG mapping) | T1053.005 Scheduled Task; T1547.001 Registry Run Keys | Five-minute scheduled task (Check Point); Run key for USBWorm (Kaspersky) | Alert on Event ID 4698 and new Run key values |
| Collection (NHIMG mapping) | T1025 Data from Removable Media | USBWorm and USB stealers copying documents | Device control; restrict USB storage |
See MITRE ATT&CK T1566 Phishing and T1204 User Execution for the core techniques.
How they abuse identities and credentials
- Browser-stored passwords: Crimson steals browser credentials. Staff who save webmail and portal passwords in the browser hand those accounts to the implant. Use a managed password manager and phishing-resistant MFA on webmail and VPN.
- Attacker-owned SaaS identities: ElizaRAT's Slack and Google Drive variants authenticate with tokens and a service account the attacker controls. That traffic is authenticated and encrypted, so the control point is which tenants and workspaces endpoints may reach, not the destination IP.
- Trusted personas: the lures impersonate defence bodies, government portals and conference organisers. DMARC enforcement on your own domains and look-alike domain monitoring reduce how convincing those personas are. See the Email Security Guide.
- Linux desktop users: the 2025 .desktop campaign ran as the logged-in user and persisted through user-level autostart and systemd units, so no root access was needed. Limit what standard accounts can schedule and monitor user systemd units.
Notable activity
| Date | Activity | Source |
|---|---|---|
| 2013 onwards | Earliest activity tracked by Kaspersky; 2016 public naming by Proofpoint | Kaspersky; ATT&CK |
| June 2019 to June 2020 | Crimson campaigns with USBWorm; victims in 27 countries, mostly India and Afghanistan | Kaspersky, August 2020 |
| 2019 to early 2021 | Honeytrap, CV, COVID, military and conference lures; ObliqueRAT hosted on a compromised Indian website | Cisco Talos, May 2021 |
| Late 2023 to 2024 | ElizaRAT campaigns using Telegram, Slack and Google services for C2, delivered as .cpl files | Check Point, November 2024 |
| August 2025 | .desktop files disguised as PDFs targeting BOSS Linux in Indian government | CYFIRMA, August 2025 |
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Office processes spawning scripts or writing executables under %ALLUSERPROFILE% | EDR; Sysmon Event IDs 1 and 11 | Macro-based droppers documented by Kaspersky |
| control.exe or rundll32.exe launching .cpl files from Downloads or %TEMP% | EDR process telemetry | ElizaRAT delivery via Control Panel files |
| Slack, Telegram or Google API traffic from non-browser processes or unsanctioned tenants | Proxy; CASB; firewall with TLS inspection where lawful | Cloud service C2 |
| Scheduled tasks firing every few minutes that call rundll32 | Event ID 4698; EDR | Persistence pattern reported by Check Point |
| Executables written to removable drives, or hidden folders replaced with look-alikes | EDR; device control logs | USBWorm behaviour |
| New .desktop files in autostart directories, new user systemd units or crontab entries on Linux desktops | auditd; Linux EDR; file integrity monitoring | 2025 Linux persistence |
| Inbound email from newly registered look-alike domains of defence or government bodies | Email gateway; message trace | Impersonation lures |
Phased response plan
- Close the attachment paths: block macros in Office files from the internet, quarantine archives containing executables, .cpl, .lnk or .desktop files, and sandbox the rest. Run the policy in report mode for two weeks, review false positives, then enforce; keep the previous policy for rollback.
- Control SaaS egress: allow only sanctioned Slack workspaces and Google tenants, and block or alert on Telegram API access from corporate endpoints where it has no business use.
- Harden Linux desktops: monitor autostart directories and user systemd units, mount home and temporary directories noexec where operations allow, and include Linux endpoints in EDR coverage.
- Control removable media: restrict USB storage to approved encrypted devices and log file copies, especially on restricted networks.
- Protect accounts: phishing-resistant MFA for webmail and VPN, no browser-saved passwords on managed devices, and a fast path for staff to report suspicious mail. See the Phishing Report Button and User Reported Message Triage Guide.
- Brief the people targeted: show staff real lure themes (CVs, conference invitations, pay commission notices, honeytraps) and include personal devices and accounts in the advice.
Decision guidance
- Small organisations and suppliers: macro blocking, attachment filtering for archives, MFA and a password manager remove most of the documented chain at low cost.
- Government and defence: add SaaS tenant restrictions, device control and Linux desktop telemetry, and share indicators with national CERT channels such as CERT-In.
- Air-gapped or restricted networks: treat USB transfer as the primary risk and enforce one-way, scanned transfer stations.
Metrics
- Percentage of endpoints blocking macros in files from the internet.
- Number of inbound messages with archives containing executables, .cpl or .desktop files that reached a mailbox (target zero).
- Percentage of Linux desktops reporting to EDR or auditd.
- Number of endpoints able to reach unsanctioned Slack, Telegram or Google tenants.
- Median time from a staff phishing report to message removal across all mailboxes.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Email and attachment filtering | SI-3, SI-8 | DE.CM-09 |
| Egress and SaaS boundary control | SC-7 | DE.CM-01 |
| Least functionality and execution control | CM-7 | PR.PS-01 |
| Removable media | MP-7 | PR.DS-01 |
| Authentication | IA-2 | PR.AA-03 |
| Awareness for targeted staff | AT-2 | PR.AT-01 |
Common failure patterns
- Allowing all SaaS by default: Slack, Telegram and Google traffic is trusted, which is why the group uses it for C2.
- Leaving Linux desktops out of monitoring: a government move to Linux does not remove the threat; the 2025 campaign followed it.
- Filtering .exe but not .cpl, .lnk or .desktop: the group changes file types to slip past simple extension rules.
- Training on generic phishing only: these lures are tailored to defence careers, pay and conferences, and some use personal relationships.
- Unrestricted USB on sensitive networks: worm and stealer components were built specifically for removable media.
Practitioner checklist
- Block macros in Office files from the internet across all endpoints.
- Quarantine archives containing executables, .cpl, .lnk or .desktop files.
- Restrict Slack, Telegram and Google access to sanctioned tenants.
- Monitor scheduled tasks, Run keys and rundll32 launches of unusual DLLs.
- Monitor Linux autostart entries, user systemd units and crontabs.
- Enforce device control for USB storage and log file copies.
- Enforce phishing-resistant MFA and stop browser password saving.
- Run lure-specific awareness for defence, government and research staff.
Standards and references
- MITRE ATT&CK: Transparent Tribe (G0134)
- Kaspersky: Transparent Tribe, evolution analysis, part 1
- Cisco Talos research on Transparent Tribe (May 2021)
- Check Point Research: The evolution of Transparent Tribe's new malware
- CYFIRMA: APT36 targets Indian BOSS Linux systems with weaponised autostart files
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: ATT&CK Remote Access Trojans Software Hub · Sidewinder Threat Actor Profile Guide · Patchwork Threat Actor Profile Guide · MITRE ATT&CK T1566 Phishing · Email Security Guide · India IT Act 2000 and SPDI Rules