Pakistan-Linked Cyber Attacks Target Indian Sectors with Python, Golang, and Rust Malware

Introduction

In a recent spate of concerning cyber incidents, the Pakistan-affiliated group Transparent Tribe has set its sights on India's governmental, defense, and aerospace sectors, employing sophisticated attacks that underscore the persistent threat posed by this adversary.

Ongoing Threats

Transparent Tribe, also known as APT36, Earth Karkaddan, Mythic Leopard, Operation C-Major, and PROJECTM, has been flagged by the BlackBerry Research and Intelligence Team for its ongoing activities, which are expected to continue. This group has a notorious history of cyber espionage targeting Indian government, military, and educational institutions, necessitating robust vulnerability management and cyber threat intelligence measures to thwart their efforts.

Utilization of Online Platforms

A notable aspect of Transparent Tribe's recent campaign is its utilization of widely-used online platforms like Discord, Google Drive, Slack, and Telegram to deliver malicious payloads, demonstrating the group's adaptability and technical expertise in evading traditional endpoint security measures.

Targeted Companies in Bengaluru

The spear-phishing attacks were particularly focused on three key companies in Bengaluru, integral to the Department of Defense Production (DDP), highlighting the critical need for effective risk management framework implementation to protect against such targeted threats. While specific names were not disclosed, the targets are believed to include Hindustan Aeronautics Limited (HAL), Bharat Electronics Limited (BEL), and BEML Limited.

Diverse Malware Usage

Transparent Tribe employs a diverse array of malware, including CapraRAT, CrimsonRAT, ElizaRAT, GLOBSHELL, LimePad, ObliqueRAT, Poseidon, PYSHELLFOX, Stealth Mango, and Tangelo, underscoring the importance of robust endpoint security measures to detect and mitigate such threats effectively.

Attack Methodology

The group's attack methodology typically begins with spear-phishing emails containing malicious links or ZIP archives, increasingly focusing on distributing ELF binaries due to the Indian government's reliance on Linux-based systems. Infections often lead to the deployment of GLOBSHELL, a Python-based information-gathering tool, and PYSHELLFOX, which exfiltrates data from Mozilla Firefox, emphasizing the need for comprehensive endpoint security solutions.

Tactical Evolution

Transparent Tribe's tactical evolution is evident in its use of ISO images in phishing campaigns since October 2023, deploying a Python-based remote access trojan that uses Telegram for command and control (C2), highlighting the importance of continuous cyber threat intelligence monitoring to stay ahead of evolving threats.

Conclusion

At Foresiet , we recognize the critical importance of safeguarding against such sophisticated threats through vulnerability management, cyber threat intelligence, endpoint security, and a robust risk management framework. Our advanced cybersecurity solutions are designed to detect and mitigate these evolving tactics, ensuring the protection of sensitive data and infrastructure, and securing your digital future.

About Foresiet!

Foresiet is the pioneering force in digital security solutions, offering the first integrated Digital Risk Protection SaaS platform. With 24x7x365 dark web monitoring and proactive threat intelligence, Foresiet safeguards against data breaches and intellectual property theft. Our robust suite includes brand protection, takedown services, and supply chain assessment, enhancing your organization's defense mechanisms. Attack surface management is a key component of our approach, ensuring comprehensive protection across all vulnerable points. Compliance is assured through adherence to ISO27001, NIST, GDPR, PCI, SOX, HIPAA, SAMA, CITC, and Third Party regulations. Additionally, our advanced antiphishing shield provides unparalleled protection against malicious emails. Trust Foresiet to empower your organization to navigate the digital landscape securely and confidently.