Log in Request a demo

Threat group profile

APT36

Also known as Transparent Tribe, Mythic Leopard, ProjectM

MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least 2013.

In short

MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least 2013. It mainly targets diplomatic, defense and research organizations in India and Afghanistan with weaponized documents, lookalike websites and remote access trojans such as Crimson.

Last updated 10 October 2026

Profile MapThreat Group
  1. Attributed OriginPakistan
  2. Names5names in public reportsTransparent Tribe · APT36 · COPPER FIELDSTONE
  3. Sectors5named as targetsIndia and Afghanistan · India · Not stated
  4. Techniques13in the attack chainResource Development · Initial Access · Execution
  5. Tools5tools and malware listedCrimson · ObliqueRAT · Peppy

In one minute

Who they are
MITRE ATT&CK describes Transparent Tribe (APT36) as a suspected Pakistan-based threat group active since at least 2013. No government advisory opened names the group, so this profile rests on MITRE ATT&CK pages alone.
Who they target
MITRE says it primarily targets diplomatic, defense and research organizations in India and Afghanistan. In one campaign between December 2021 and July 2022 it went after students in India.
How they usually get in
MITRE lists spearphishing emails with malicious attachments or links, weaponized documents with macros, and websites with malicious links and iframes. It also registers lookalike domains that mimic file sharing, government, defense and research sites.
What stands out
MITRE lists a family of remote access trojans, Crimson, ObliqueRAT and Peppy, that are described as similar to each other, plus the commodity tools njRAT and DarkComet. It also records that the group can hide real folders and replace them with malicious copies of the same name.
What to do first
Block unexpected attachments and macros, check links before opening them, switch on SPF, DKIM and DMARC, and watch for lookalike domains that imitate your organization.

Names

Public reports use several names for this activity.

Names used for APT36
NameWhere it appears
Transparent Tribe Main name on the MITRE ATT&CK group page G0134[1]
APT36 MITRE ATT&CK Associated Groups[1]
COPPER FIELDSTONE MITRE ATT&CK Associated Groups[1]
Mythic Leopard MITRE ATT&CK Associated Groups[1]
ProjectM MITRE ATT&CK Associated Groups[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Describes Transparent Tribe as a suspected Pakistan-based threat group that has been active since at least 2013.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says the group primarily targets diplomatic, defense and research organizations in India and Afghanistan.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Lists four associated names: COPPER FIELDSTONE, APT36, Mythic Leopard and ProjectM.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Records campaign C0011, from December 2021 to July 2022, in which the group targeted students in India with the Crimson malware.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says the Crimson remote access trojan has been used by Transparent Tribe since at least 2016.[2]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says the ObliqueRAT trojan, similar to Crimson, has been used by the group since at least 2020.[3]

Where sources differ

No government advisory, indictment or sanction opened names Transparent Tribe, APT36 or Mythic Leopard. MITRE ATT&CK itself uses the word "suspected" for the Pakistan link and names no agency or unit behind the group, so no state sponsor is given on this page.

Who they target

Sectors

  • India and AfghanistanMITRE says the group primarily targets diplomatic organizations in these two countries.[1]
  • India and AfghanistanMITRE says the group primarily targets defense organizations in these two countries.[1]
  • India and AfghanistanMITRE says the group primarily targets research organizations in these two countries.[1]
  • IndiaMITRE says that in campaign C0011 the group registered domains likely designed to appear relevant to student targets in India, and sent malicious attachments by email to student targets.[1]
  • Not statedMITRE says the group registered domains that mimic file sharing, government, defense and research websites.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2012

    Peppy in use

    MITRE says the Python-based Peppy trojan, which it lists for the group, has been active since at least 2012.[4]

  2. At least 2013

    Earliest activity

    MITRE says Transparent Tribe has been active since at least 2013.[1]

  3. At least 2016

    Crimson in use

    MITRE says Crimson has been used by the group since at least 2016.[2]

  4. At least 2020

    ObliqueRAT in use

    MITRE says ObliqueRAT has been used by the group since at least 2020.[3]

  5. December 2021 to July 2022

    Campaign C0011

    MITRE records a campaign against student targets in India that used typo-squatted domains, lure documents with VBA macros and the Crimson malware.[1]

  6. 31 July 2026

    MITRE profile updated

    The MITRE ATT&CK page for Transparent Tribe was last modified on this date (version 1.2).[1]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Domains T1583.001

    MITRE says it registered domains that mimic file sharing, government, defense and research websites.[1]

  • Compromise Infrastructure: Domains T1584.001

    MITRE says it has compromised domains for use in targeted campaigns.[1]

  • Stage Capabilities: Drive-by Target T1608.004

    MITRE says it set up websites with malicious hyperlinks and iframes to infect visitors with Crimson, njRAT and other tools.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE says it sent spearphishing emails with attachments that deliver malicious payloads.[1]

  • Phishing: Spearphishing Link T1566.002

    MITRE says it embedded links to malicious downloads in emails.[1]

  • Drive-by Compromise T1189

    MITRE says it used websites with malicious hyperlinks and iframes to infect targeted victims.[1]

Execution

  • User Execution: Malicious File T1204.002

    MITRE says it used weaponized documents in email to compromise targeted systems.[1]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    MITRE says it crafted VBS-based malicious documents, and in C0011 used VBA macros in a lure document to install Crimson.[1]

  • Exploitation for Client Execution T1203

    MITRE says it crafted files that exploit CVE-2012-0158 and CVE-2010-3333.[1]

Command and Control

  • Dynamic Resolution T1568

    MITRE says it used dynamic DNS services to set up command and control.[1]

Stealth

  • Hide Artifacts: Hidden Files and Directories T1564.001

    MITRE says it can hide legitimate directories and replace them with malicious copies of the same name.[1]

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    MITRE says it can mimic legitimate Windows directories by using the same icons and names.[1]

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    MITRE says it dropped encoded executables on compromised hosts.[1]

Tools and malware

  • Crimson Remote access trojan

    MITRE says Transparent Tribe has used it since at least 2016, including in campaign C0011.[2]

  • ObliqueRAT Remote access trojan

    MITRE says it is similar to Crimson and has been used by the group since at least 2020.[3]

  • Peppy Python-based remote access trojan

    MITRE says it has been active since at least 2012 and has similarities with Crimson.[4]

  • njRAT Remote access tool

    MITRE lists it among the tools delivered through the group's malicious websites.[1]

  • DarkComet Remote administration tool

    MITRE lists it among the software used by the group.[1]

Also linked in our threat library:

Detection and defense

  1. Block unknown attachments

    MITRE advises blocking unknown or unused attachment types by default and scanning inbound attachments with network intrusion prevention.

    Counters T1566.001

  2. Authenticate email

    MITRE advises SPF, DKIM and DMARC to filter messages on the validity of the sender domain, which helps against lookalike senders.

    Counters T1566.002

  3. Check links and downloads

    MITRE advises blocking unknown or unused file types in transit and blocking sites that cannot be monitored well.

    Counters T1204.001 T1566.002

  4. Control macros and execution

    MITRE advises attack surface reduction rules and application control to stop files that arrive by email or masquerade as other types from running.

    Counters T1204.002 T1059.005

  5. Patch and sandbox client software

    MITRE advises regular updates, browser sandboxes and exploit protection against client-side exploitation, including the old flaws (CVE-2012-0158 and CVE-2010-3333) the group used.

    Counters T1203 T1189

  6. Train staff

    MITRE advises user training on spearphishing and suspicious links and files.

    Counters T1204.001 T1204.002

What Brandefense can do

Questions

Who is APT36?

APT36 is another name for Transparent Tribe. MITRE ATT&CK describes it as a suspected Pakistan-based threat group active since at least 2013. It also lists COPPER FIELDSTONE, Mythic Leopard and ProjectM as associated names.

Who does Transparent Tribe target?

MITRE says it primarily targets diplomatic, defense and research organizations in India and Afghanistan. In a campaign from December 2021 to July 2022 it also targeted students in India.

How does Transparent Tribe get in?

MITRE lists spearphishing emails with malicious attachments or links, weaponized documents with VBA macros, lookalike domains and websites with malicious hyperlinks and iframes.

What malware does Transparent Tribe use?

MITRE lists Crimson, ObliqueRAT, Peppy, njRAT and DarkComet. Crimson has been used since at least 2016.

Has a government named Transparent Tribe?

No government advisory opened for this page names the group. The attribution here rests on MITRE ATT&CK, which calls the Pakistan link "suspected".

What should a company do first?

Block unexpected attachments and macros, enable SPF, DKIM and DMARC, and watch for lookalike domains, as MITRE advises for these techniques.

In our research

  1. APT41: China’s Dual-Purpose Cyber Powerhouse November 2025
  2. Operation C-Major (APT36): A Persistent Pakistan-Linked Cyber Espionage Threat November 2025
  3. Poseidon Malware Technical Analysis The APT 36 Campaign February 2024
  4. [Research Summary]: APT 36 Campaign – Poseidon Malware July 2023
  5. Mythic Leopard APT Group August 2022

Sources

  1. Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM, Group G0134 MITRE ATT&CK Supports: Names, description, campaign C0011, techniques, software, version and dates
  2. Crimson, Software S0115 MITRE ATT&CK Supports: Crimson description, use since at least 2016
  3. ObliqueRAT, Software S0644 MITRE ATT&CK Supports: ObliqueRAT description, use since at least 2020
  4. Peppy, Software S0643 MITRE ATT&CK Supports: Peppy description, active since at least 2012
  5. njRAT, Software S0385 MITRE ATT&CK Supports: njRAT description
  6. DarkComet, Software S0334 MITRE ATT&CK Supports: DarkComet description
  7. Phishing: Spearphishing Attachment, Sub-technique T1566.001 MITRE ATT&CK Supports: Technique name and mitigations
  8. Phishing: Spearphishing Link, Sub-technique T1566.002 MITRE ATT&CK Supports: Technique name and mitigations
  9. User Execution: Malicious Link, Sub-technique T1204.001 MITRE ATT&CK Supports: Technique name and mitigations
  10. User Execution: Malicious File, Sub-technique T1204.002 MITRE ATT&CK Supports: Technique name and mitigations
  11. Drive-by Compromise, Technique T1189 MITRE ATT&CK Supports: Technique name and mitigations
  12. Exploitation for Client Execution, Technique T1203 MITRE ATT&CK Supports: Technique name and mitigations
  13. Acquire Infrastructure: Domains, Sub-technique T1583.001 MITRE ATT&CK Supports: Technique name
  14. Hide Artifacts: Hidden Files and Directories, Sub-technique T1564.001 MITRE ATT&CK Supports: Technique name

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more

Technique

Drive-by Compromise

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

Read more