Transparent Tribe

Transparent Tribe is a threat actor known for conducting malicious campaigns against organizations in South Asia. The group has been linked to the ObliqueRAT malware and CrimsonRAT through its infrastructure, which includes the domains vebhost[.]com, zainhosting[.]net/com, and others. The group has also used CapraRAT backdoor against Indian and Pakistani users, as reported by news outlets in April 2023. Additionally, ESET researchers have identified an ongoing campaign by Transparent Tribe targeting mainly Indian and Pakistani Android users with military or political backgrounds. Cisco Talos has been tracking a new malicious campaign operated by Transparent Tribe that uses a spear-phishing attack to distribute the CrimsonRAT malware disguised as a Microsoft Word document. The document contains a macro that downloads the malware onto the victim's computer. Researchers from Talos believe that the group is using this campaign to establish long-term access into victim networks. The constantly changing operational and targeting strategies of Transparent Tribe require constant vigilance to mitigate the threat posed by the group. Organizations in South Asia, particularly those with military or political affiliations, should be aware of the group's activities and take appropriate measures to protect themselves from cyber attacks.