Threat Actor 🇵🇰 Pakistan

Operation C-Major

Also known as: C-Major · Transparent Tribe · Mythic Leopard · ProjectM · APT36 · APT 36 · TMP.Lapis · Green Havildar · COPPER FIELDSTONE · Earth Karkaddan · Storm-0156

Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.

Indicators of Compromise 2

Domain modgovindia[.]com Domain modgovindia[.]space

MITRE ATT&CK TTPs 1

T1059.001

PowerShell

Execution

Source Articles

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

APT36, also known as Transparent Tribe, has targeted Indian government entities using spear-phishing emails delivering a Golang-based DeskRAT malware. The campaign primarily targets BOSS Linux systems, leveraging malicious Desktop files and cloud storage services to distribute payloads. DeskRAT establishes persistence through multiple methods and communicates with C2 servers via WebSockets, enabling file exfiltration and remote execution. The group has evolved to use custom malware, indicating increased sophistication.

hacker-news