APT36

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor that has been persistently targeting Indian government organizations, diplomatic personnel, and military facilities. This group has been involved in several malicious campaigns, with the most recent one being tracked by Cisco Talos. APT36 is notorious for its use of custom tools such as ElizaRAT, a Windows Remote Access Tool (RAT) first disclosed in September 2023, and ApoloStealer, which employs techniques similar to other Transparent Tribe malware. These tools have been deployed in targeted attacks on high-profile entities in India, with multiple likely successful campaigns observed in 2024. The Transparent Tribe APT group has shown a distinctive pattern in their operations, including the use of unique authorship attributes in their decoy files, specifically the name "Apolo Jones". The same name has been found in various aspects of Transparent Tribe’s operations and across samples of malware associated with the group. They also maintain a network of malicious domains under the names vebhost[.]com and zainhosting[.]net/com, operated by "ZainHosting", which are used to register, renew, and administer several malicious web pages over time. In terms of attack vectors, APT36 has demonstrated innovation and adaptation. In 2023, Zscaler documented the group's unprecedented use of Linux desktop entry files as an attack vector. Furthermore, while the weaponization of legitimate tooling is not a new phenomenon among threat actors, Transparent Tribe only started using ISO images, which typically appear as disks to the operating system, toward the end of 2023 according to BlackBerry. This highlights the group's persistent efforts to evolve their tactics and techniques to achieve their malicious objectives.