Operation C-Major (APT36): A Persistent Pakistan-Linked Cyber Espionage Threat

APT36 is also called Operation C-Major or Transparent Tribe. It is a cyber espionage group that MITRE ATT&CK describes as suspected to be Pakistan-based. It has been active since at least 2013.

It targets government, defense, diplomatic and research organizations, mainly in India. The post says its aim is long-term intelligence gathering, not financial gain. It uses spear phishing, remote access trojans and Android spyware.

For a sourced summary, see our Transparent Tribe (APT36) threat group profile. It sets out names, techniques and tools as MITRE ATT&CK records them.

Introduction

Global cyber conflict keeps changing. State-linked advanced persistent threat (APT) groups still play a central part in espionage and influence missions. One of them is Operation C-Major, better known as APT36. It has stayed relevant due to its persistence, adaptability, and focus on strategic intelligence collection.

It has gone by a sequence of different names: Transparent Tribe, Earth Karkaddan, Green Havildar, Mythic Leopard, COPPER FIELDSTONE, Storm-0156, ProjectM, and TMP.Lapis. APT36 is still a high-priority adversary for defenders in the government, defense, and research sectors.

This blog post looks at APT36’s identity, motivations, tactics, operations, and recent activities. It aims to give an organized view of APT36’s long-term relevance to the global cybersecurity landscape.

Who Is APT36 and What Motivates It?

APT36 has been active since at least 2013. It is generally attributed to operators based in Pakistan.

APT36 members have an overarching goal of cyber espionage. They mainly target institutions and individuals tied to the strategic interests of South Asia, specifically India.

APT36’s motivation is geopolitical:

• Collecting military and defense focused intelligence against competing nations
• Monitoring policy and research missions
• Building regional influence by infiltrating educational, governmental, and strategic organizations

Ransomware actors seek financial gain. APT36 is different. It is an intelligence-gathering operation for the long haul.

This level of persistence can be more dangerous than financially motivated ransomware actors, who may yield an initial attack. In many cases, the attacker wants the victim to remain unaware of the attack for as long as possible.

TTPs (Tactics, Techniques & Procedures)

APT36 has an assorted, but recognizable, toolkit. The tactics evolve, but some have been consistent throughout.

• Initial Access:

• Spear phishing emails with malicious file attachments disguised as documents from defense or government agencies.
  • Fake job offers intended for defense, government, and academic targets.
  • Malicious Android apps that mimicked legitimate tools or government apps.

• Persistence:

• Creates scheduled tasks or registry modifications.
  • Deploys trojanized software to set up long-term footholds once other means of persistence have been removed.

• Command & Control (C2):

• Uses HTTP/S, dynamic DNS, and cloud service for communication.
  • Use encrypted communications to evade detection.

• Malware and Tools:

• CrimsonRAT: A remote access trojan that has been APT36’s flagship RAT for years. They have used variations of it since the early days of the group.
  • ObliqueRAT: An emerging RAT delivered via compromised websites and phishing attachments. It appeared at the same time CrimsonRAT began emerging.
  • CapraRAT: An Android surveillance tool.
  • Various custom Android spyware apps to collect data from mobile devices.

• Techniques:

• Exploitation of Office macros and PDF exploits.
  • Use of social engineering tactics to target military and academic personnel.
  • Data exfiltration using encrypted communication.

These TTPs show that APT36 can combine inexpensive phishing-based techniques with custom espionage malware. They show both adaptability and effectiveness.

Notable Operations (Timeline)

Over the last decade, APT36 has run several high-profile campaigns. They show its continued persistence and expansion.

• 2016–2018: A wave of spear-phishing campaigns targeted Indian military and governmental organizations. They often used malicious documents related to defense operations roughly formed by a hallmark.
• 2020: The use of ObliqueRAT, delivered via legitimate government websited that had been compromised.
• 2022–2023: The group expanded into mobile spyware, using CapraRAT and delivering Android APKs that monitored military personnel, diplomats, and civilian academics.
• 2024–2025: The group resumed spear phishing campaigns that used defense and research lures. It kept using Android surveillance apps. It also expanded the affected geography outside of India. This included the Middle East and Europe, and North America.

Recent Developments (2024–2025)

Recent intelligence assessments stress a marked change in APT36’s activity patterns. India continues to be the main threat vector. But the group has also added to its models and regional targeting scope:

• Wider Geographic Reach: APT36 campaigns now extend into Europe, Middle East and North America. This is a wider-scale espionage effort.
• Mobile Expansion: Increased use of Android-based spyware to allow deeper access to personal communications and mobility data.
• Persistent Phishing: Continued use of spear-phishing emails. They now show improved sophistication and localization to bypass traditional defenses.

These changes show how APT36 can adapt to global security environments. It collects intelligence against suspected states. It stays relevant even as detection and defense mechanisms continue to improve.

Strategic Impact

The longevity of this Operation C-Major is a strategic concern to cybersecurity itself. Its targeting of military, government and research places a strong emphasis on the group’s goals. These goals are to sustain disruption and monitoring of an adversarial state’s actions. Three implications stand out:

1. Regional Geopolitics: By centering APT36 efforts on particular institutions in India, APT36 can carry out its activities in support of its foreign policy objectives of Pakistan and South Asia.
2. Global Expansion: APT36 footprint is increasingly present in Europe and North America. This points to a larger global operational aspiration, and possible international collaboration.
3. Mobile Espionage Capacity: APT36’s increased usage of Android spyware reflects adults in modern engagement in intelligence collection. Mobile applications use mobile devices as a gateway into the personal and professional manner.

How Can Organizations Defend Against APT36?

Organizations may improve their protective posture against APT36 with actionable steps, including:

• Phishing Defense: Routine training. Include advanced email filtering and phishing simulations.
• Endpoint Security: EDR (Endpoint Detection & Response) tools to reveal Remote Access Tool activity
• Mobile Security: MDM (Mobile Device Management) and threat detection for Android mobile devices
• Threat Intelligence: Use threat intelligence feeds to track IOCs and campaigns as they evolve.
• Zero Trust Principles: Limit lateral movement with strict access and segmentation.

APT36 is successful in part because it exploits social engineering and the user. So human-focused security awareness is as important as technical defense.

Conclusion

Operation C-Major (APT36) illustrates the tenacity and adaptability of modern state-linked APT actors. In over a decade, it evolved from a regional espionage entity into a multi-platform, globally active threat actor.

India remains a central focus for APT36. However, its recent activity in further stages of Europe, the Middle East, and North America shows an ambition for broad-scale intelligence-gathering.

From a defensive standpoint, APT36 should be understood as more than a technical threat. It is a geopolitical mechanism to achieve Pakistan’s long-term priorities for intelligence collection.

A combination of vigilance, proactive defensive mechanisms, and a strong incident-response approach can help organizations reduce their exposure to this longstanding, adaptive adversary.

You can download and review the sheet for all the details!