Transparent Tribe Revisited: Persistent Pakistan-Linked APT Exploits Cross-Platform Cloud Environments

Background

Transparent Tribe (also tracked as APT36, ProjectM, Earth Karkaddan and Mythic Leopard) is a Pakistan‑linked espionage group active since at least 2013. The group typically targets Indian government agencies, defence and aerospace contractors and educational institutions by sending spear‑phishing emails that deliver malicious ZIP/ISO attachments. Transparent Tribe’s operations are wide ranging: they develop both Windows and Linux malware, compromise Android devices and have recently adopted cross‑platform languages such as Python, Go and Rust. Attack infrastructure discovered by researchers includes IP addresses in Pakistan and malware files compiled in the Asia/Karachi time zone, reinforcing links to a Pakistani threat actor.

New OTX Pulse Findings

AlienVault’s Open Threat Exchange (OTX) community recently highlighted a pulse summarising new Transparent Tribe indicators of compromise. Researchers noticed that Storm‑0501 (Microsoft’s designation for a group using Transparent Tribe malware) exploited compromised credentials and over‑privileged accounts to pivot between different cloud environments. Victims across government, manufacturing, transportation and law enforcement sectors were targeted in order to establish a ransomware‑as‑a‑service affiliate scheme. The OTX pulse ties into ongoing campaigns in which Transparent Tribe abuses cloud services such as Telegram, Google Drive, Discord and Slack for command‑and‑control communications. Organisations using hybrid or multi‑cloud infrastructures face increased risk because inconsistent identity and access controls provide attackers with a “seamless path” for lateral movement.

Toolset and Techniques

Transparent Tribe maintains a growing arsenal of custom malware and open‑source tools:

• CrimsonRAT & CapraRAT – long‑standing remote‑access tools used to harvest files, record keystrokes and exfiltrate data from Windows and Android systems.
• ElizaRAT & ApoloStealer – a newer malware family uncovered in 2023–2024. ElizaRAT is distributed via phishing emails containing CPL (Control Panel) files; it beacons to Telegram or Slack for command‑and‑control and allows attackers to execute commands, download additional payloads and steal screenshots. The ApoloStealer variant is a modular stealer that collects documents, images and authentication tokens across Windows, Linux and macOS.
• Golang & Rust‑based implants – evidence shows Transparent Tribe experimenting with Golang and Rust implants that compile into Linux ELF binaries, likely an adaptation to India’s adoption of the MayaOS Linux distribution. These implants often arrive via ISO images or spear‑phishing emails disguised as job offers or military advisories.
• Abuse of cloud services – the group hides traffic in legitimate cloud services such as Telegram bots, Discord webhooks, Google Drive uploads and Slack channels. This makes detection difficult and allows attackers to bypass perimeter security.

Multi‑Cloud Challenges

The OTX pulse underscores the difficulty of defending hybrid and multi‑cloud environments. According to Fortinet’s 2025 State of Cloud Security report, 78 % of organisations use two or more cloud providers, while Microsoft’s 2024 State of Multicloud Security Risk report notes that 86 % of companies operate in multi‑cloud environments. More than half expose at least one high‑value asset to an attack path between clouds. Security teams often lack visibility across platforms, and identity misconfigurations create an easy route for attackers. Transparent Tribe’s use of stolen credentials and over‑privileged accounts illustrates how a single compromised identity can lead to data breaches across AWS, Azure and on‑premises systems.

Defensive Recommendations

To mitigate Transparent Tribe’s campaigns, defenders should:

1. Harden identity and access management: enforce multi‑factor authentication (MFA), implement least‑privilege policies and regularly review credentials. Compromised or over‑privileged accounts were key enablers in recent attacks.
2. Deploy cloud‑security posture management (CSPM): monitor for misconfigurations, inactive credentials, public storage buckets and unused API keys across all cloud providers. Unified security policies help disrupt attack chains.
3. Detect cross‑platform malware: implement endpoint detection and response (EDR) on Windows, Linux and Android devices. Look for indicators of CrimsonRAT, CapraRAT, ElizaRAT and Golang implants using IOC feeds such as OTX pulses.
4. Educate end‑users: Transparent Tribe relies heavily on spear‑phishing. Train staff to recognise malicious attachments and impersonation emails and encourage reporting of suspicious messages.
5. Monitor cloud‑based C2 channels: inspect traffic to Telegram, Discord, Slack and Google Drive for anomalies; block unauthorised use of these services where possible.

Conclusion

Transparent Tribe remains a persistent threat actor capable of adapting its toolset and infrastructure to exploit weaknesses in multi‑cloud environments and hybrid architectures. The latest OTX pulse illustrates how compromised identities and over‑privileged accounts can enable cross‑platform campaigns. By strengthening identity controls, adopting unified cloud‑security posture management and educating users about phishing, organisations can reduce their exposure to this long‑running Pakistan‑linked espionage group.

Sources

• BlackBerry Research & Intelligence Team – Transparent Tribe Targets Indian Government, Defense, and Aerospace Sectors Leveraging Cross‑Platform Programming Languages (May 2024).
• BlackBerry Research & Intelligence Team – Transparent Tribe Targets Indian Government, Defense, and Aerospace Sectors Leveraging Cross‑Platform Programming Languages (May 2024).
• Check Point Research – Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT (Nov 2024).
• The Hacker News – IcePeony and Transparent Tribe Target Indian Entities with Cloud‑Based Tools (Nov 2024).
• Dark Reading – Defending Against Cloud Threats Across Multi‑Cloud Environments.