Skip to main content
Mallory
5 malware families

TransparentTribe

Also known astransparenttribe

TransparentTribe is a Pakistan-linked APT group, also referred to in the provided content as APT36 and Mythic Leopard. The group is described as one of the most active APT groups observed in South Asia, including in December 2025. Reported targeting includes Indian military organizations, Indian government departments, and Indian financial institutions, as well as government and military agencies in Pakistan and Bangladesh. The content specifically states that TransparentTribe targeted Indian military organizations with DeskRAT, a Go-based remote access trojan capable of running in BOSS Linux environments, and separately describes the group as deploying an AI-assisted variant of DeskRAT against India’s BOSS Linux systems. Additional tooling mentioned includes CrimsonRAT and a module named USBWorm. The content also notes use of spear-phishing as the primary tactic in South Asia, including decoy emails targeting the Indian Ministry of Defense, and references decoys resembling those used by TransparentTribe. Sidecopy is mentioned alongside TransparentTribe in one context, but the content does not establish it as a subgroup.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • military
IOCS

Observables

9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables9

Domains, IPs, and hashes tied to this actor, refreshed continuously.

TransparentTribe | Mallory