Transparent Tribe begins targeting education sector in latest campaign
Summary: Cisco Talos found Transparent Tribe, a suspected Pakistan-linked APT, running a campaign dating to December 2021 that targets students at Indian universities and colleges with spear-phishing emails carrying maldocs whose VBA macros drop an embedded archive containing CrimsonRAT. Talos assesses with high confidence that Pakistani hosting provider ZainHosting operated parts of the campaign infrastructure, with the malicious domains resolving to 198[.]37[.]123[.]126 and sharing the administrator address rupees001[at]gmail[.]com, which has been used to register and administer roughly 2,000 domains.
Why it matters: The group's targeting has moved from government and military personnel to civilian students, and its fake student and media domains carried front pages with embedded Google Drive folders of pictures of women that Talos says will likely serve as stagers for honeytrap attacks.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026