Threat Actor 🇵🇰 Pakistan

Operation C-Major

Also known as: C-Major · Transparent Tribe · Mythic Leopard · ProjectM · APT36 · APT 36 · TMP.Lapis · Green Havildar · COPPER FIELDSTONE · Earth Karkaddan · Storm-0156

Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.

Indicators of Compromise 13

Domain indiatodays[.]org Domain modgovindia[.]com Domain modgovindia[.]space Domain theprints[.]org Filename DocScanner-11-Aug-2026-5-37pm.pdf.LNK Filename DriverInstaller.zip Filename command.txt Filename download.bin Filename heartbeat.txt Filename info.txt Filename results.txt Filename screenshot.png Filename webcam_photo.jpg

MITRE ATT&CK TTPs 1

Source Articles

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Transparent Tribe (APT36), a Pakistan-aligned threat actor, has launched a new campaign dubbed Operation RapidRust, targeting government and defense entities in India and Afghanistan. The group deployed a Rust-based backdoor called RUSTYSHADE that uses private GitHub repositories for encrypted command-and-control (C2) communications. Additional tools include RUSTYMOVE, a USB propagation tool, and file stealers PSNATCH (PowerShell) and BASHNATCH (bash) for Windows and Linux systems. Attackers used typosquatted domains impersonating Indian news sites to host malicious payloads and conducted post-compromise activities including reconnaissance and lateral movement.

hacker-news ·1mo ago

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

APT36, also known as Transparent Tribe, has targeted Indian government entities using spear-phishing emails delivering a Golang-based DeskRAT malware. The campaign primarily targets BOSS Linux systems, leveraging malicious Desktop files and cloud storage services to distribute payloads. DeskRAT establishes persistence through multiple methods and communicates with C2 servers via WebSockets, enabling file exfiltration and remote execution. The group has evolved to use custom malware, indicating increased sophistication.