APT36

APT36, also known as Transparent Tribe and Earth Karkaddan, is a threat actor group that has historically targeted government agencies and defense firms in India with cyberattacks aimed at compromising Windows systems and Android devices. The group's activities have been tracked by various cybersecurity organizations, including Cisco Talos and Zscaler. APT36 has employed tactics such as using romance scams to distribute the CapraRAT Android malware against Indian government officials with information on the Kashmir region. Furthermore, they have expanded their scope of attacks into sectors like education, demonstrating a broadening of their focus beyond traditional governmental and military targets. The Transparent Tribe group has been linked to the usage of XploitSPY, a widely available tool customized by multiple threat actors. However, the modifications found in the apps used by APT36 as part of the eXotic Visit campaign are distinctive from previously documented variants of the XploitSPY malware. The group has also been noted for weaponizing legitimate tools and services as part of its attack infrastructure, extending the living-off-the-land trend. This includes the use of ISO images targeting Windows systems, which began towards the end of 2023 according to BlackBerry. In a significant shift in tactics, Transparent Tribe has started to target Linux systems, utilizing a "desktop entry file" that appears to be a Microsoft Office document. This new attack vector was first documented by Zscaler in September 2023. Despite not being considered highly sophisticated, Transparent Tribe has had success by diversifying its tactics. All three sets of domains - the malicious Transparent Tribe infrastructure, vebhost[.]com, and zainhosting[.]net/com - are related, with "ZainHosting" owning and operating the malicious infrastructure. These domains have been used to register, renew, and administer several malicious web pages over time, including those used by the Transparent Tribe APT in their most recent campaigns.