- Category
- State · Attributed to a state or working for one.
- Origin
- Pakistan(high confidence)
- Sponsor
- Pakistan
- Motivation
- Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0134 · 14 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0101 · transparent-tribe
PakistanWhat it is
Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Mythic Leopard
- Mandiant
- APT 36, APT36, TEMP.Lapis
- Microsoft
- Storm-0156
- MITRE ATT&CK
- G0134
- Qihoo 360
- APT-C-56
- Secureworks
- COPPER FIELDSTONE
- Trend Micro
- Earth Karkaddan
- Operations
- Operation C-Major, Operation “C-Major”, Operation “Honey Trap”, Operation “Transparent Tribe”
- Other names
- C-Major, Green Havildar, Opaque Draco, ProjectM, SideCopy, STEPPY-KAVACH, TMP.Lapis, Transparent Tribe, APT 36
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTPakistan
- MISP Galaxy (CFR tagging)Pakistan
- MicrosoftPakistan
- ThreatActor.info (Malpedia et al.)Pakistan
Targets
- Countries
- Afghanistan, Australia, Austria, Azerbaijan, Belgium, Botswana, Bulgaria, Canada, China, Czech, Germany, India, Iran, Japan, Kazakhstan, Kenya, Malaysia, Mongolia, Nepal, Netherlands, Oman, Pakistan, Romania, Saudi Arabia, Spain, Sweden, Thailand, Türkiye, United Arab Emirates, United Kingdom, United States
- Sectors
- Activists, Civil society, Defense, Education, Embassies, Government, Military
Tools
The tools and malware families the sources tie to it.
- Crimson
- DarkComet
- ObliqueRAT
- Peppy
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de