PakistanSuspectedPakistan-basedEspionageActive 2013 – 2026
Transparent Tribe
Also known asCOPPER FIELDSTONE · Mythic Leopard · APT-C-56 · ProjectM · Temp.Lapis · Green Havildar · Operation C-Major · Earth Karkaddan · STEPPY-KAVACH · Opaque Draco · TMP.Lapis
Summary
Pakistan-attributed group almost exclusively targeting Indian military and government. Distributes CrimsonRAT via fake Indian government job portals and honeytrap apps. Expanded to Linux and Android platforms.
Attribution
SuspectedSuspected link: Pakistan-based
No service publicly attributed
Hedged, circumstantial or press-only reporting; not established.
Sources
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected Pakistan-based
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Operation RapidRust | 2026-08 – 2026-09 | India, Afghanistan | Government, Defense | Zscaler ThreatLabz (2026-09-16) — RUSTYSHADE Rust backdoor with private-GitHub C2, RUSTYMOVE USB propagation, PSNATCH/BASHNATCH stealers; hands-on activity 20 Aug–1 Sep 2026, weekdays 04:00–11:00 UTC |
| PATCHCORD / SHEETCORD — Afghan telecom & South Asian critical infrastructureASSESSED | 2026-03 – ongoing | Afghanistan, India | Telecommunications, Energy, Government | Acronis TRU (2026-08-13) — fake AFTEL VPN / telecom-management installers deliver PATCHCORD (C/C++); SHEETCORD (Go, Google Sheets C2); HACKERAI C2 agent; Indian energy-sector variant Mar 2026; moderate-confidence APT36 overlap |
| DeskRAT on BOSS Linux — Indian defence | 2025-08 – 2025-09 | India | Defense, Government | Sekoia TDR (2025-10-23) — phishing ZIP with .desktop file → decoy PDF + Golang DeskRAT (WebSocket C2, systemd/cron/autostart/bashrc persistence); lures on Aug/Sep 2025 protests |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution3 | T1204.002Malicious FileT1059.001PowerShellT1053.003Cron |
| Persistence1 | T1543.002Systemd Service |
| Lateral Movement1 | T1091Replication Through Removable Media |
| Command and Control2 | T1071.001Web ProtocolsT1102.002Bidirectional Communication |
Malware and tools 8
| Name | Description | Platform |
|---|---|---|
| CrimsonRAT | RAT | Windows |
| ObliqueRAT | RAT | Windows |
| CAPRAT | Android RAT | Android |
| RUSTYSHADE | Backdoor (Rust, GitHub C2) | Windows |
| RUSTYMOVE | USB Propagation Tool | Windows |
| PSNATCH | File Stealer (PowerShell) | Windows |
| BASHNATCH | File Stealer (Bash) | Linux |
| DeskRAT | RAT (Golang, WebSocket C2) | Linux |
Exploited vulnerabilities 2
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2012-0158 | 8.8 | Microsoft Windows Common Controls (MSCOMCTL.OCX) — RCE (KEV 2021-11-03) |
| CVE-2010-3333 | 7.8 | Microsoft Office — RTF stack buffer overflow RCE (KEV 2022-03-03) |
Highest CVSS first.
Infrastructure patterns
- Typo-squatted domains with their own SSL certs host lures; dynamic DNS for C2 (MITRE ATT&CK, 2026)
Reporting and advisories 4
- Zscaler ThreatLabz
Operation RapidRust - Sekoia TDR
DeskRAT on BOSS Linux — Indian defence - Acronis TRU
PATCHCORD / SHEETCORD — Afghan telecom & South Asian critical infrastructure - MITRE ATT&CK
Transparent Tribe (G0134) group profile