Transparent Tribe
Transparent Tribe is a Pakistan-associated threat actor also tracked as APT36, Copper Fieldstone, Earth Karkaddan, Mythic Leopard, Operation C-Major, and ProjectM. The reporting also describes SideCopy as a Pakistan-linked cluster operating under the broader Transparent Tribe/APT36 umbrella. Transparent Tribe has a documented history of targeting South Asian government institutions and has been reported targeting entities in Afghanistan, India, Pakistan, and Saudi Arabia. Recent reporting tied umbrella-related activity to espionage campaigns against Afghanistan’s Ministry of Finance and provincial finance bodies using Pashto-language spearphishing lures and Xeno RAT, while other reporting noted targeting of Indian entities and sectors including defense, government, railways, and oil. Observed tradecraft in the provided content includes spearphishing emails with malicious attachments, including ZIP archives containing LNK files disguised as PDFs, weaponized documents, and other malicious email attachments sent to targets such as students in India. Transparent Tribe activity in the content includes abuse of mshta.exe to retrieve HTA payloads, in-memory decoding and loader chains, registry-based persistence, scheduled-task persistence, masquerading as legitimate software such as Microsoft Edge, use of encoded executables, and mimicry of legitimate Windows directories by reusing names and icons. Malware and tooling associated in the content include CrimsonRAT, MeshAgent, Xeno RAT, CurlBack RAT, Spark RAT, and the Linux-targeting DeskRAT implant. The content also associates Transparent Tribe with phishing using weaponized Linux .desktop files and with detections for malicious file execution and UDL-file-based spearphishing attachment activity. The content explicitly describes Transparent Tribe/APT36 as Pakistan-based or Pakistan-associated, and separately describes SideCopy as Pakistan-linked and believed to be an element of the Pakistani government, but only as a subgroup or cluster under the broader Transparent Tribe umbrella.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- PK
Tradecraft
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
39 malware families attributed to this actor across reporting.
34 additional families tracked in Mallory.
Associated vulnerabilities
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
...has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.
...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Observables
117 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pakistan-linked threat actor referenced as the broader group associated with SideCopy and known for targeting neighboring countries.
Broader threat umbrella associated in the content with the Pakistan-linked SideCopy cluster behind a cyber espionage operation targeting Afghan government entities.
Broader threat cluster associated in the content with SideCopy and prior targeting of Indian entities using similar malware.
Pakistan-linked threat actor umbrella associated with SideCopy and assessed behind a phishing campaign targeting Indian military and defense infrastructure using WhatsApp-based social engineering and weaponized Linux .desktop files.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.