Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia

The threat actor known as Transparent Tribe (also called APT36) has been attributed with a fresh set of attacks targeting Indian government, academic, and strategic entities using a remote access Trojan (RAT) to maintain persistent control over compromised hosts. The campaign employs deceptive delivery techniques, including a weaponised Windows shortcut (LNK) file masquerading as a legitimate PDF document and embedded with full PDF content to evade user suspicion, according to CYFIRMA.

The malware deploys via a spear-phishing email containing a ZIP archive with a LNK file disguised as a PDF, and the final RAT payload is loaded in memory after an HTA script invoked by mshta.exe, with a decoy PDF opened in parallel. The second HTA file includes a DLL named "iinneldc.dll" that functions as a fully-featured RAT, supporting remote system control, file management, data exfiltration, screenshot capture, clipboard manipulation, and process control.

Persistence is achieved differently depending on the antivirus detected, including creating startup folder items or registry-based mechanisms, and the campaign has also been linked to another attack using a malicious shortcut disguised as a government advisory PDF to deliver additional components. CYFIRMA notes that APT36 remains highly persistent and strategically driven in its focus on Indian government, educational, and related targets.