CYFIRMA Reports Transparent Tribe Campaign Targeting Indian Government and Defense Organizations
Summary
CYFIRMA reports that Transparent Tribe (APT36) is targeting Indian government and defense organizations with social-engineered ZIPs, LNK and PPAM-based execution, and a RAT for covert monitoring and data exfiltration.
Key points
- CYFIRMA attributes the campaign to Pakistan-aligned Transparent Tribe (APT36) and says it targets Indian government-associated and defense organizations.
- The ZIP lure contains a deceptive shortcut named “Approved Documents 2026.pdf.lnk”.
- A hidden batch script and the Brief.ppam PowerPoint add-in's Auto_Open VBA macro contribute to payload deployment and reconstruction.
- The article says the malware establishes Windows Startup Registry persistence, removes Mark-of-the-Web, uses junk code, and uses fimsrwvar.exe to delete executables.
- The reported final RAT, hsuzoiaisaacrhy.exe, connects to hardcoded C2 IP 93.127.130.89, with a fallback domain also mentioned.
- CYFIRMA reports that the RAT can capture screenshots, monitor screens, browse files, and exfiltrate data in chunks.
Article Details
- Event Type
- Multi-stage cyber espionage campaign targeting Indian government-associated and defense organizations.
- Impact
- The campaign deploys a Remote Access Trojan for remote monitoring, screenshot capture, file browsing, and staged data exfiltration, with persistence and evasion mechanisms intended to support long-term covert access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 93[.]127[.]130[.]89 | Hardcoded command-and-control IP address used by the RAT. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware uses junk code to make analysis more difficult.T1059.001 · PowerShellPowerShell is used to remove the Mark-of-the-Web security flag from files.T1113 · Screen CaptureThe RAT captures screenshots of victim systems.T1204.002 · Malicious FileThe infection chain depends on a user interacting with the deceptive shortcut or PowerPoint add-in.T1547.001 · Registry Run Keys / Startup FolderThe malware modifies the Windows Startup Registry to run when the user logs on.T1553.005 · Mark-of-the-Web BypassThe campaign removes the Mark-of-the-Web security flag from its files.
Threat Actors
APT36Named as an alternate name for Transparent Tribe, which CYFIRMA identifies as responsible for the campaign targeting Indian government-associated and defense organizations.Transparent TribeIdentified by CYFIRMA as the actor behind the campaign targeting Indian government-associated and defense organizations; the article also names APT36 as an alternate name.
Malware
fimsrwvar.exeThe malware establishes persistence, removes Mark-of-the-Web, uses junk code for evasion, and self-deletes via fimsrwvar.exe.hsuzoiaisaacrhy.exeThe operation uses deceptive LNK shortcuts and a PowerPoint PPAM with macro-based payload reconstruction to deploy a RAT (hsuzoiaisaacrhy.exe) that connects to a hardcoded C2 and enables covert data exfiltration.
Products
Microsoft PowerPointThe operation uses deceptive LNK shortcuts and a PowerPoint PPAM with macro-based payload reconstruction to deploy a RAT (hsuzoiaisaacrhy.exe) that connects to a hardcoded C2 and enables covert data exfiltration.Microsoft WindowsEstablishes Persistence: Modifies the Windows Startup Registry to run whenever the user logs on.
Countries
Industries
Defensea sophisticated campaign by Pakistan-aligned Transparent Tribe (APT36) targeting Indian government and defense organizations using social-engineered ZIPs and a multi-stage infection chain for long-term espionage.Governmentexposed a sophisticated campaign by Pakistan-aligned Transparent Tribe (APT36) targeting Indian government and defense organizations using social-engineered ZIPs and a multi-stage infection chain for long-term