TRANSPARENT TRIBE LAUNCHES NEW RAT ATTACKS AGAINST INDIAN GOVERNMENT AND ACADEMIA

Summary from the TLDR InfoSec newsletter

Transparent Tribe (APT36) deployed remote access trojans against Indian governmental, academic, and strategic entities through spear-phishing emails containing weaponized LNK files disguised as PDFs that execute remote HTA scripts via mshta.exe to deliver the final RAT payload. The malware employs adaptive persistence mechanisms based on detected antivirus solutions, with the deployed DLL supporting remote system control, file management, data exfiltration, screenshot capture, and clipboard manipulation capabilities. The campaign demonstrates Transparent Tribe's continuous toolkit evolution, with related activity linking the group to Patchwork APT and the new StreamSpy trojan that uses WebSocket channels for C2 communication to evade HTTP traffic detection.