Log in Request a demo

Malware profile

Crimson RAT

Also known as MSIL/Crimson

Crimson RAT is a remote access trojan for Windows.

In short

Crimson RAT is a remote access trojan for Windows. MITRE ATT&CK lists the group Transparent Tribe (APT36) as the user and says the group has used it since at least 2016. It can log keystrokes, capture screens, webcam video and audio, and collect files, including from removable drives.

Last updated 10 October 2026

Profile MapMalware
  1. Names3names in public reportsCrimson · MSIL/Crimson · Crimson RAT
  2. Techniques20ATT&CK techniques listedCollection · Credential Access · Discovery
  3. Linked Groups1groups that use itAPT36

In one minute

What it is
A remote access trojan (RAT) for Windows, called Crimson and MSIL/Crimson by MITRE ATT&CK.
What it does
Collects files and system details, logs keystrokes, takes screenshots, records webcam video and audio, reads Outlook email and steals browser credentials.
Who uses it
MITRE lists Transparent Tribe (APT36), which it describes as a suspected Pakistan-based threat group, as the user. CERT-EU records researchers' reports of APT36 using Crimson RAT against Indian government entities.
How it gets in
MITRE records a Visual Basic macro in a lure document that installed Crimson in campaign C0011. CERT-EU records malicious Excel files with embedded macros in April 2025.
What to do first
Stop Office macros in files that come from the internet, and watch for odd outbound traffic, because MITRE says Crimson uses a custom TCP protocol instead of ordinary web traffic.

What it does

MITRE says Crimson is patient. It can check how long it has been installed on a host and downloads its final payload only after at least 15 days. It uses a custom TCP protocol for command and control.

It can also spread by infecting removable media and has a module that collects data from removable drives, so USB sticks are part of the risk.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
CrimsonName of MITRE ATT&CK software S0115[1]
MSIL/CrimsonAlias listed by MITRE ATT&CK[1]
Crimson RATName used in CERT-EU Cyber Briefs 24-07 and 25-05[4, 5]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Collection

  • Data from Local System T1005

    It can collect information from a compromised host.[1]

  • Data from Removable Media T1025

    It has a module to collect data from removable drives.[1]

  • Input Capture: Keylogging T1056.001

    It can use a module to log keystrokes.[1]

  • Screen Capture T1113

    It has a command to take screenshots.[1]

  • Video Capture T1125

    It can capture webcam video.[1]

  • Audio Capture T1123

    It can perform audio surveillance using microphones.[1]

  • Email Collection: Local Email Collection T1114.001

    It has a command to collect and exfiltrate email from Outlook.[1]

Credential Access

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    It has a module to steal credentials from web browsers.[1]

Discovery

  • File and Directory Discovery T1083

    It has commands to list files and folders and to search for files with chosen extensions.[1]

  • Software Discovery: Security Software Discovery T1518.001

    It has a command to collect information about anti-virus software.[1]

Execution

  • Command and Scripting Interpreter: Windows Command Shell T1059.003

    It can run commands through the COMSPEC environment variable.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    It can add Registry run keys to stay on the machine.[1]

Defense Impairment

  • Modify Registry T1112

    It can set a Registry key to record how long it has been installed and possibly its version.[1]

Stealth

  • Virtualization/Sandbox Evasion: Time Based Checks T1497.003

    It can work out whether it has been installed for at least 15 days before it downloads the final payload.[1]

  • Indicator Removal: File Deletion T1070.004

    It can delete files from a compromised host.[1]

Lateral Movement

  • Replication Through Removable Media T1091

    It can spread across systems by infecting removable media.[1]

Command and Control

  • Non-Application Layer Protocol T1095

    It uses a custom TCP protocol for command and control.[1]

  • Application Layer Protocol: Web Protocols T1071.001

    It can use an HTTP GET request to download its final payload.[1]

  • Ingress Tool Transfer T1105

    It has a command to fetch files from its command server.[1]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    It can send stolen information over its command channel.[1]

How it spreads

MITRE says Crimson can spread across systems by infecting removable media. For delivery, MITRE records that in campaign C0011 Transparent Tribe used malicious VBA macros in a lure document as part of installing Crimson. CERT-EU records, from a researchers' report, that an April 2025 campaign delivered Crimson RAT through malicious Excel files with embedded macros that also showed a decoy document, and that a 2024 campaign used spear phishing and compromised domains to deliver payloads.

Timeline

  1. At least 2016

    Crimson in use

    MITRE says Transparent Tribe has used Crimson since at least 2016.[1]

  2. June 2024

    CERT-EU reports Pakistan-linked groups using Crimson

    CERT-EU Cyber Brief 24-07 records a researchers' report that Pakistan-linked groups, including Transparent Tribe (APT36), escalated attacks on Indian government entities with RATs including AllaKore and Crimson, using spear phishing and compromised domains.[4]

  3. April 2025

    CERT-EU reports a Crimson RAT campaign with Pahalgam-themed lures

    CERT-EU Cyber Brief 25-05 records a researchers' report that APT36 used decoy documents on the Pahalgam attack to target Indian government entities with Crimson RAT delivered in Excel files with embedded macros.[5]

Detection and defense

  1. Block risky macros

    MITRE advises keeping Office from running VBA macros in files marked as coming from the internet, and attack surface reduction rules for Visual Basic scripts. Campaign C0011 and the 2025 Excel lures used macros.[9]

  2. Control removable media

    MITRE advises blocking unsigned or untrusted executables from running from USB drives, disabling Autorun, and limiting USB devices where they are not needed.[6]

    Counters: T1091 T1025

  3. Watch and filter network traffic

    MITRE advises filtering protocols that are not needed across the network boundary, limiting outgoing traffic to necessary ports and using network signatures for known malware. Crimson uses a custom TCP protocol.[7]

    Counters: T1095 T1071.001

  4. Restrict outbound web traffic

    MITRE advises limiting outbound HTTP and HTTPS from critical servers to approved destinations.[10]

    Counters: T1071.001 T1105

  5. Review persistence points

    MITRE says Run key persistence is hard to stop with preventive controls and points to detecting new Run key entries that start programs from unusual paths.[8]

    Counters: T1547.001

  6. Know what is not published

    No government advisory with Crimson RAT detection signatures or indicators was found. Use MITRE S0115 and CERT-EU Cyber Briefs 24-07 and 25-05 as the official references.[1, 4, 5]

Questions

What is Crimson RAT?

MITRE ATT&CK describes Crimson as a remote access Trojan for Windows that Transparent Tribe has used since at least 2016.

Who uses Crimson RAT?

MITRE lists Transparent Tribe, also called APT36, a suspected Pakistan-based group active since at least 2013 that mainly targets diplomatic, defense and research organizations in India and Afghanistan. CERT-EU records researchers' reports of APT36 using it against Indian government entities.

What can Crimson RAT do?

MITRE lists keylogging, screenshots, webcam and microphone capture, Outlook email collection, browser credential theft and collection of files from removable drives.

How does Crimson RAT get onto a computer?

MITRE says it can spread through removable media and records VBA macros in a lure document in campaign C0011. CERT-EU records Excel files with embedded macros in April 2025.

How does Crimson RAT talk to its operators?

MITRE says it uses a custom TCP protocol for command and control, and can use an HTTP GET request to download its final payload.

In our research

  1. Mythic Leopard APT Group August 2022

Sources

  1. Crimson, Software S0115 MITRE ATT&CKSupports: Description, aliases, platform, techniques with use sentences, Transparent Tribe as the listed group
  2. Transparent Tribe, Group G0134 MITRE ATT&CKSupports: Group described as suspected Pakistan-based, active since at least 2013
  3. C0011 MITRE ATT&CKSupports: Campaign dates, targets, VBA macros in a lure document, updated Crimson
  4. CERT-EU Cyber Brief 24-07, June 2024 CERT-EUSupports: Pakistan-linked groups and Transparent Tribe using Crimson against Indian government entities
  5. CERT-EU Cyber Brief 25-05, April 2025 CERT-EUSupports: APT36 Pahalgam-themed lures delivering Crimson RAT in Excel files
  6. Replication Through Removable Media, T1091 MITRE ATT&CKSupports: Mitigations M1040, M1042 and M1034
  7. Non-Application Layer Protocol, T1095 MITRE ATT&CKSupports: Mitigations M1037, M1031 and M1030
  8. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, T1547.001 MITRE ATT&CKSupports: Detection of Run key persistence
  9. Command and Scripting Interpreter: Visual Basic, T1059.005 MITRE ATT&CKSupports: Mitigations for Visual Basic and macros
  10. Application Layer Protocol: Web Protocols, T1071.001 MITRE ATT&CKSupports: Mitigation M1037 on outbound web traffic

Browse the threat library

Keep exploring

Knowledge Hub

Article

Mythic Leopard APT Group

Mythic Leopard, also called APT36 and Transparent Tribe, is a suspected Pakistan-based group. See aliases, targets, timeline, tools and defenses.

Read more

Glossary term

Remote access trojan (RAT)

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Data from Local System

Data from local system is when an attacker searches a computer they already control to find files and other data worth taking.

Read more