Introduction
Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan. Proofpoint Operation Transparent Tribe March 2016 Kaspersky Transparent Tribe August 2020 Talos Transparent Tribe May 2021
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
- C0011 (C0011): C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from Transparent Tribe’s historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
Tactics, Techniques, and Procedures (TTPs)
- T1189 Drive-by Compromise
- T1608.004 Drive-by Target
- T1204.002 Malicious File
- T1027.013 Encrypted/Encoded File
- T1568 Dynamic Resolution
- T1584.001 Domains
- T1059.005 Visual Basic
- T1566.002 Spearphishing Link
- T1036.005 Match Legitimate Resource Name or Location
- T1583.001 Domains
- T1564.001 Hidden Files and Directories
- T1203 Exploitation for Client Execution
- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
ATT&CK technique IDs (denormalized)
- T1027.013
- T1036.005
- T1059.005
- T1189
- T1203
- T1204.001
- T1204.002
- T1564.001
- T1566.001
- T1566.002
- T1568
- T1583.001
- T1584.001
- T1608.004
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- DarkComet (S0334) — malware
- ObliqueRAT (S0644) — malware
- njRAT (S0385) — malware
- Crimson (S0115) — malware
- Peppy (S0643) — malware
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [6] Crowdstrike Mythic Leopard Profile Crowdstrike. (n.d.). Mythic Leopard. Retrieved October 6, 2021. [7] Kaspersky Transparent Tribe August 2020 Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. [8] Unit 42 ProjectM March 2016 Falcone, R. and Conant S. (2016, March 25). ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe. Retrieved September 2, 2021. [9] Proofpoint Operation Transparent Tribe March 2016 Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. [10] Talos Transparent Tribe May 2021 Malhotra, A. et al. (2021, May 13). Transparent Tribe APT expands its Windows malware arsenal. Retrieved September 2, 2021. [11] Secureworks COPPER FIELDSTONE Profile Secureworks. (n.d.). COPPER FIELDSTONE. Retrieved October 6, 2021.
Recent News
Latest articles from security news feeds mentioning this actor.
- Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 The Hacker News — 2026-09-18