Transparent Tribe APT expands its Windows malware arsenal
Summary: Transparent Tribe, also tracked as APT36 and Mythic Leopard, is expanding its Windows malware arsenal beyond CrimsonRAT to include ObliqueRAT, delivered through fake domains that mimic Indian defense and government sites and through domains posing as file-sharing services. Cisco Talos found the group registered clawsindia[.]com to impersonate the Center For Land Warfare Studies think tank, hosted on 164[.]68[.]101[.]194, a known CrimsonRAT command-and-control IP, with a mail[.]clawsindia[.]com subdomain suggesting a malspam campaign. Its targeting has widened from military and defense personnel to diplomatic entities, defense contractors, research organizations, and conference attendees.
Why it matters: The group's TTPs have stayed largely unchanged since 2020, yet it keeps adding lures and a second implant, so defenses tuned to CrimsonRAT alone may not catch ObliqueRAT arriving from a cloned think-tank domain or a lookalike file-sharing site.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026