{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt36",
    "slug": "apt36",
    "name": "APT36",
    "shortName": "APT36",
    "country": "Pakistan",
    "countryCode": "PK",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2013",
    "prominence": 70,
    "mitreGroupId": "G0134",
    "malpediaSlug": "transparent_tribe",
    "tagline": "Pakistani collection aimed almost exclusively at Indian military and government targets, increasingly through Android implants.",
    "bio": "APT36 — commonly reported as Transparent Tribe — runs a narrowly focused collection programme against Indian military, paramilitary, government, and defence-research targets. It is one of the most single-minded actors tracked: essentially all documented activity serves Pakistani interests with respect to India.\n\nThe group's tradecraft is not sophisticated, but it is well matched to its targets. Lures reference Indian military documents, defence procurement notices, and government circulars with enough authenticity to suggest access to genuine material. Its flagship implant, Crimson RAT, has been in continuous use for years with incremental refinement rather than replacement.\n\nIts most operationally interesting characteristic is the emphasis on mobile. The group builds Android implants — CapraRAT and its variants — and distributes them through fake dating applications, trojanised chat apps, and repackaged legitimate software aimed at military personnel. Several documented campaigns used romance-themed social engineering to persuade individual soldiers to install the applications, a route to communications, location, and camera access that no enterprise security programme covers.\n\nMore recently the group has expanded to Linux, targeting the BOSS distribution used by parts of the Indian government, and has adopted ClickFix-style lures that persuade users to paste commands into their own terminal.",
    "attribution": {
      "sponsor": "Pakistan",
      "service": "Pakistani state interests (specific service not publicly designated)",
      "confidence": "moderate",
      "summary": "Assessed as aligned with Pakistani state interests by Proofpoint, Cisco Talos, Kaspersky, and Indian government reporting, based on exclusive targeting of Indian military and government entities, Pakistani-language and timezone artifacts, and infrastructure registration patterns. No formal government attribution has been issued and no individuals have been indicted.",
      "sources": [
        {
          "org": "Proofpoint",
          "title": "Operation Transparent Tribe",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf",
          "date": "2016-03-01"
        },
        {
          "org": "Kaspersky GReAT",
          "title": "Transparent Tribe: Evolution analysis",
          "url": "https://securelist.com/transparent-tribe-part-1/98127/",
          "date": "2020-08-20"
        }
      ]
    },
    "motivations": [
      "espionage"
    ],
    "targetSectors": [
      "Defense",
      "Government",
      "Education",
      "Think Tanks & Academia",
      "Aerospace",
      "Nuclear",
      "Media & Journalism"
    ],
    "targetCountries": [
      "India",
      "Afghanistan",
      "Nepal",
      "Sri Lanka"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "Transparent Tribe",
        "url": "https://attack.mitre.org/groups/G0134/",
        "correlation": "exact"
      },
      {
        "org": "crowdstrike",
        "name": "Mythic Leopard",
        "correlation": "exact"
      },
      {
        "org": "proofpoint",
        "name": "Operation C-Major",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "ALUMINUM SARATOGA",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "Transparent Tribe",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "APT36",
        "correlation": "exact"
      },
      {
        "org": "trendmicro",
        "name": "Earth Karkaddan",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Storm-0156",
        "correlation": "partial",
        "note": "Microsoft's cluster for related Pakistani activity, whose infrastructure Turla was documented hijacking in 2024"
      }
    ],
    "tools": [
      {
        "name": "Crimson RAT",
        "type": "backdoor",
        "custom": true,
        "description": "The group's long-running .NET implant, supporting screenshots, file theft, webcam capture, and process control.",
        "malpediaSlug": "win.crimson"
      },
      {
        "name": "CapraRAT",
        "type": "malware",
        "custom": true,
        "description": "Android implant distributed via fake dating and messaging apps, providing access to messages, calls, location, and camera.",
        "malpediaSlug": "apk.caprarat"
      },
      {
        "name": "ObliqueRAT",
        "type": "backdoor",
        "custom": true,
        "description": "Windows backdoor delivered through malicious documents and, in some campaigns, steganographic payload hiding.",
        "malpediaSlug": "win.obliquerat"
      },
      {
        "name": "Poseidon",
        "type": "backdoor",
        "custom": true,
        "description": "Golang implant targeting the BOSS Linux distribution used in parts of the Indian government."
      },
      {
        "name": "Fake app stores",
        "type": "utility",
        "custom": false,
        "description": "Websites distributing trojanised Android applications aimed at military personnel."
      }
    ],
    "techniques": [
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access",
        "note": "Indian military and government document lures"
      },
      {
        "tCode": "T1566.002",
        "name": "Phishing: Spearphishing Link",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1204.002",
        "name": "User Execution: Malicious File",
        "tactic": "Execution",
        "note": "Trojanised Android applications installed by targets themselves"
      },
      {
        "tCode": "T1204.004",
        "name": "User Execution: Malicious Copy and Paste",
        "tactic": "Execution",
        "note": "ClickFix-style lures persuading users to run commands in their own terminal"
      },
      {
        "tCode": "T1585.001",
        "name": "Establish Accounts: Social Media Accounts",
        "tactic": "Resource Development",
        "note": "Romance personas approaching military personnel"
      },
      {
        "tCode": "T1056.001",
        "name": "Input Capture: Keylogging",
        "tactic": "Collection"
      },
      {
        "tCode": "T1125",
        "name": "Video Capture",
        "tactic": "Collection"
      },
      {
        "tCode": "T1113",
        "name": "Screen Capture",
        "tactic": "Collection"
      },
      {
        "tCode": "T1025",
        "name": "Data from Removable Media",
        "tactic": "Collection",
        "note": "USB monitoring to reach documents from isolated systems"
      },
      {
        "tCode": "T1071.001",
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2017-0199",
        "firstExploited": "2018-03-01",
        "usage": "OLE2link RTF exploit delivering Crimson RAT in phishing against Indian defence targets.",
        "source": {
          "org": "Cisco Talos",
          "title": "Transparent Tribe: Evolution analysis and campaign tracking",
          "url": "https://blog.talosintelligence.com/transparent-tribe-targets-education/",
          "date": "2022-07-13"
        }
      },
      {
        "cveId": "CVE-2012-0158",
        "firstExploited": "2016-01-01",
        "usage": "MSCOMCTL overflow used in early campaigns against Indian military targets.",
        "source": {
          "org": "Proofpoint",
          "title": "Operation Transparent Tribe",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf",
          "date": "2016-03-01"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "sidewinder",
        "type": "operational-overlap",
        "confidence": "moderate",
        "note": "Direct regional adversaries — SideWinder targets Pakistani military and government, APT36 targets Indian."
      },
      {
        "relatedActorId": "turla",
        "type": "operational-overlap",
        "confidence": "moderate",
        "note": "Microsoft and Lumen documented Turla hijacking the C2 infrastructure of the related Storm-0156 cluster in 2024."
      }
    ],
    "reports": [
      {
        "org": "Kaspersky GReAT",
        "title": "Transparent Tribe: Evolution analysis",
        "url": "https://securelist.com/transparent-tribe-part-1/98127/",
        "date": "2020-08-20"
      },
      {
        "org": "Cisco Talos",
        "title": "Transparent Tribe targets Indian education sector with CrimsonRAT",
        "url": "https://blog.talosintelligence.com/transparent-tribe-targets-education/",
        "date": "2022-07-13"
      },
      {
        "org": "SentinelOne",
        "title": "CapraRAT Android malware distributed via fake dating apps",
        "url": "https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/",
        "date": "2023-09-18"
      }
    ],
    "campaigns": [],
    "flag": "🇵🇰",
    "profile": "/apt/apt36/"
  }
}