TransparentTribe
TransparentTribe is a Pakistan-linked APT group, also referred to in the provided content as APT36 and Mythic Leopard. The group is described as one of the most active APT groups observed in South Asia, including in December 2025. Reported targeting includes Indian military organizations, Indian government departments, and Indian financial institutions, as well as government and military agencies in Pakistan and Bangladesh. The content specifically states that TransparentTribe targeted Indian military organizations with DeskRAT, a Go-based remote access trojan capable of running in BOSS Linux environments, and separately describes the group as deploying an AI-assisted variant of DeskRAT against India’s BOSS Linux systems. Additional tooling mentioned includes CrimsonRAT and a module named USBWorm. The content also notes use of spear-phishing as the primary tactic in South Asia, including decoy emails targeting the Indian Ministry of Defense, and references decoys resembling those used by TransparentTribe. Sidecopy is mentioned alongside TransparentTribe in one context, but the content does not establish it as a subgroup.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- military
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active in South Asia during Dec 2025, primarily conducting spear-phishing email campaigns targeting government and military entities (notably India; also Pakistan, Bangladesh, and Romania mentioned).
TransparentTribe is a Pakistani APT group known for targeting Indian military organizations using custom malware such as DeskRAT.
Described as a Pakistan-linked APT deploying the DeskRAT malware in an AI-assisted manner to target India’s BOSS Linux systems.
Mentioned as a comparative reference for decoy/document themes overlapping with Sidecopy-related campaigns; no specific new operation detailed here.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.