MITRE ATT&CKgroup
G0134 Transparent Tribe
- Domain
- enterprise
- Aliases
- COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM
- Version
- 1.2
- Created
- 2021-09-02
Description
Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.
Related
Uses · MITRE ATT&CK (19)
- T1027.013 Encrypted/Encoded File sub-technique
- S0644 ObliqueRAT software (malware)
- S0643 Peppy software (malware)
- T1608.004 Drive-by Target sub-technique
- T1584.001 Domains sub-technique
- T1583.001 Domains sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1568 Dynamic Resolution technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- S0385 njRAT software (malware)
- S0334 DarkComet software (malware)
- T1189 Drive-by Compromise technique
- T1203 Exploitation for Client Execution technique
- S0115 Crimson software (malware)
Referenced by MITRE ATT&CK · attributed to (1)
- C0011 C0011 campaign
References
- https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/ Crowdstrike Mythic Leopard Profile
- https://securelist.com/transparent-tribe-part-1/98127/ Kaspersky Transparent Tribe August 2020
- https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/ Unit 42 ProjectM March 2016
- https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf Proofpoint Operation Transparent Tribe March 2016
- https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html Talos Transparent Tribe May 2021
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone Secureworks COPPER FIELDSTONE Profile