APT36
Pakistan
Tracked by CyberSIXT since 25 Aug 2025
- Articlesall time
- 18
- Articleslast 30 days
- 1
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 2
18 articles from 5 outlets; the latest 10 days ago.
- Article
- Research report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
MITRE ATT&CK describes APT36, tracked as Transparent Tribe, as a suspected Pakistan-based threat group that has been active since at least 20131. It says the group primarily targets diplomatic, defense and research organizations in India and Afghanistan1. MITRE ATT&CK also lists the names COPPER FIELDSTONE, Mythic Leopard and ProjectM2. MISP Galaxy lists Pakistan as sponsor and records Earth Karkaddan and Storm-0156 as further names3,4.
Security Affairs reported that APT36 targeted Indian government and defense entities with Linux .desktop files delivered through spear-phishing emails carrying a malicious archive disguised as a PDF5. GBHackers reported a spear-phishing campaign against Indian government entities that impersonated NIC eEmail Services and used lookalike domains and a fake login portal to capture email addresses and passwords6. Dark Reading reported that Transparent Tribe used Patchcord and Sheetcord against Afghan government and telecom entities and tried to breach Indian organizations, without confirmed successes7.
MITRE ATT&CK lists Crimson, DarkComet, njRAT, Peppy and ObliqueRAT as software associated with the group8.
Sources
- APT36: description · MITRE ATT&CK
- APT36: alias · MITRE ATT&CK
- APT36: sponsor · MISP Galaxy
- APT36: alias · MISP Galaxy
- Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign · Security Affairs · 2025-08-25
- Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government · GBHackers · 2025-10-21
- Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks · Dark Reading · 2026-08-20
- APT36: software · MITRE ATT&CK
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Diamond Model
What the record links to APT36Recorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
12 names- Operation C-Major
- CyberSIXT coverage, Malpedia, MISP Galaxy
- APT36
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- C-Major
- Malpedia, MISP Galaxy
- COPPER FIELDSTONE
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Earth Karkaddan
- Malpedia, MISP Galaxy
- Green Havildar
- Malpedia, MISP Galaxy
- Mythic Leopard
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- ProjectM
- Malpedia, MISP Galaxy, MITRE ATT&CK®
4 more names
- Storm-0156
- Malpedia, MISP Galaxy
- TMP.Lapis
- Malpedia, MISP Galaxy
- Transparent Tribe
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- APT-36
- CyberSIXT coverage
Attributed facts
- Origin
Pakistan MISP Galaxy
- Sponsor
Pakistan MISP Galaxy
- Sectors
Activists, Civil society, Government, Military MISP Galaxy
Malware and tools
MITRE ATT&CK® · G0134 5
MITRE ATT&CK® techniques
14 techniques · 5 tacticsFrom MITRE ATT&CK® · G0134
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- AI Is Making Cyberattacks Noisier, Not More SophisticatedDark Reading
- APT36 Uses Fake News Sites to Target India and Afghanistan GovernmentsSecurityOnline
- Transparent Tribe Linked to Rust Backdoor Using GitHub for C2The Hacker News
- Pakistan's Transparent Tribe Refreshes Toolset for Afghan CyberattacksDark Reading
- APT36 Uses PATCHCORD Malware Against Afghan Telecom, Indian GovtSecurityOnline
- APT36 uses fake VPN installers to deploy PATCHCORD backdoorSecurity Affairs
- SheetAgent RAT hits Indian job seekers via fake govt zipSecurityOnline
- Transparent Tribe builds AI driven mass implants to hit IndiaThe Hacker News
- APT36 scales AI driven malware line to hit Indian entitiesDark Reading
- APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian EntitiesThe Hacker News
- Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against IndiaSecurityOnline
- Transparent Tribe Launches New RAT Attacks Against Indian Government and AcademiaThe Hacker News
The latest 12 are listed. See all 18 articles in the timeline.