Transparent Tribe (APT36): The Persistent Threat to Indian Government and Defence
A profile of the Pakistan-nexus espionage group that has spent a decade targeting Indian government, military and education, with Crimson RAT, CapraRAT on Android, and an ever-shifting set of lures. Who they are, how they operate, and what to watch for.
On this page
If there's one adversary every Indian defender should be able to describe from memory, it's Transparent Tribe — tracked as APT36, Mythic Leopard, ProjectM and C-Major. It's a Pakistan-nexus espionage group that has, for the better part of a decade, aimed almost exclusively at India: government departments, the military, defence contractors, and education and research institutions.
It isn't technically dazzling. It doesn't need to be. Its edge is relentless, well-themed social engineering against a consistent set of targets, and a willingness to follow those targets onto whatever platform they use — Windows, Android, and increasingly Linux.
At a glance
- Aliases: APT36, Mythic Leopard, ProjectM, C-Major
- Suspected origin: Pakistan-nexus
- Primary targets: Indian government, military/defence, diplomats, education and research
- Signature malware: Crimson RAT (Windows), CapraRAT (Android), ElizaRAT, Poseidon
- Delivery: spear-phishing with weaponised Office documents, OLE objects, LNK files, and fake/trojanised apps
- MITRE ATT&CK: G0134 — Transparent Tribe
Who they target, and why
APT36's targeting is remarkably stable: Indian defence personnel, government staff, and the organisations around them. Lures lean on exactly what those people open without thinking — documents dressed as official memos, awards, pay or pension circulars, defence tenders, and conference invitations, frequently themed around India-Pakistan affairs or military matters.
The goal is intelligence collection: credentials, documents, and persistent access to sensitive networks. This is espionage, not fraud, which is what makes it a strategic problem rather than a financial one.
How they operate
- Crimson RAT is the workhorse — a .NET remote access trojan delivered through malicious macro documents, capable of file theft, screenshots, keylogging and command execution. It has appeared in campaign after campaign for years.
- CapraRAT extends the group onto Android, bundled into trojanised or fake apps (video players, chat apps, and lures aimed at specific communities), stealing messages, contacts, location and media.
- ElizaRAT and Poseidon represent the group's continued investment in new tooling rather than resting on Crimson RAT alone.
- Delivery keeps evolving to defeat defences: macro docs gave way to OLE and LNK-based chains and installer tricks, and the group has repeatedly experimented with Linux targeting — relevant because parts of the Indian government run BOSS Linux and other Linux desktops.
The through-line is consistency of intent with flexibility of method. The lure theme and the payload change; the target set doesn't.
What defenders should do
- Harden the document path. Disable Office macros by policy, block or sandbox OLE object execution, and treat
.lnkfiles arriving by email or in archives as hostile. Most APT36 chains die here. - Cover Android, not just endpoints. Enforce installs from the Play Store only on managed devices, and treat any "app" delivered by link — especially to defence or government staff — as suspect. CapraRAT lives in sideloaded APKs.
- Hunt for Crimson RAT behaviour. Office spawning script interpreters or unknown .NET binaries, beaconing to unfamiliar hosts, and new persistence (Run keys, scheduled tasks) tied to document opens.
- Phishing-resistant MFA on government and defence mailboxes raises the cost of the credential theft that underpins these operations.
The takeaway
Transparent Tribe is the baseline threat for Indian government and defence networks — not flashy, but patient, well-resourced in social engineering, and unlikely to go away. The right posture is to assume the lures will keep coming, make the document and Android delivery paths expensive, and watch for the handful of RATs the group reuses. It's tracked in the India Threat Tracker alongside the other actors operating in and around India.
This article reflects public information as of 10 September 2026, and summarises long-running public reporting on the group.
