Transparent Tribe campaign uses new bespoke malware to target Indian government officials
Summary: Cisco Talos observed Transparent Tribe, also known as APT36 and Mythic Leopard and suspected to be Pakistan-linked, running a campaign against Indian government and military personnel using fake domains mimicking legitimate military and defense organizations. The campaign delivered three implant types, two of them previously unobserved, through downloaders masquerading as installers for the Kavach MFA application, a 141MB downloader carrying the legitimate Kavach MSI in its resources, and infection vectors that shifted from maldocs to IMG files in June 2021, VHDX files in September 2021, and password-protected RAR archives in November 2021.
Key Takeaway: The attackers built a downloader that checks for an India timezone before proceeding and wrapped payloads in VHDX files that strip Mark of the Web, so Microsoft's own warnings never fire - and the lures were installers for Kavach, the MFA tool Indian government and military personnel use to reach government email.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026