Operation C-MajorThreat actor
- apt 36
- APT36
- c-major
- copper fieldstone
- earth karkaddan
- green havildar
- mythic leopard
- projectm
- storm-0156
- tmp.lapis
- Transparent Tribe
Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek11 reports
ATT&CK techniques
6 of 31 · each with the sentence it comes from- T1053.005Scheduled Task
“Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”
- T1027Obfuscated Files or Information
“… GOSHELL shellcode loader was designed to execute only on specific hostnames by comparing the victim's hostname against a hardcoded list.T1027.001Defense Evasion, Obfuscated Files or Information: Binary PaddingThe threat actor used the GOSHELL shellcode loader that was inflated t…”
- T1027.009Embedded Payloads
“…ng junk bytes.T1027.009Defense Evasion, Obfuscated Files or Information: Embedded PayloadsThe GOGITTER downloader binary contained embedded payloads such as the windows_api.vbs.”
- T1036Masquerading
“…formationThe Cobalt Strike Beacon loader decodes the second-stage shellcode and the Beacon payload using HEX-decoding and XOR operations.T1036.004Defense Evasion, Masquerading: Masquerade Task or ServiceThe GOGITTER downloader creates a scheduled task, MicrosoftEdge_Configur…”
- T1053Scheduled Task/Job
“… APIThe GOSHELL shellcode loader used the QueueUserAPC native API call to execute the second-stage shellcode within its own process.T1053.005Persistence, Scheduled Task/Job: Scheduled TaskThe GOGITTER downloader created a scheduled task to execute a dropped VBScript every 50…”
- T1059Command and Scripting Interpreter
“…ing LinkThe threat actor used phishing PDFs which contained a lure with a ‘Download and Install’ button, linking to a malicious ISO file.T1059.003Execution, Command and Scripting Interpreter: Windows Command ShellGITSHELLPAD executed commands such as net user, systeminf…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“APT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.”
-
September 2026 Threat Trend Report on APT Groups“Transparent Tribe and APT36 exploited LNK, ISO, ZIP, BAT, PowerShell, and GitHub-based C2 to attack government, defense, and diplomatic organizations.”
-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing“…9, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.”
-
Risky Bulletin: Gemini hacked three companies too“Operation RapidRust: Zscaler has observed new activity from Pakistan-nexus threat actor APT36.”
-
August 2026 Threat Trend Report on APT Groups“Transparent Tribe (APT36) targeted Afghan telecommunications companies and Indian government, defense, and energy organizations using PATCHCORD, SHEETCORD, and the HACKERAI C2 Agent.”
-
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH“Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“APT-C-56: Qihoo researchers look at new APT-C-56 (Transparent Tribe) campaigns delivering the CrimsonRAT.”
-
June 2026 CVE Landscape“…ited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated through DD-WRT routers; EKZ information-stea…”
-
TransparentTribe Targets Indian Military with DeskRAT Malware“TransparentTribe, a Pakistan-nexus intrusion set also known as APT36, targets Indian government and defense entities on Linux.”
-
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2“…nce that these campaigns likely originate from a new subgroup or a parallel Pakistan-linked group, despite sharing similarities with the APT36 threat group.”
-
APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1“While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) group, APT36, we assess with medium confidence that the activity identified during this analysis might originate from a new subgroup or another Pakistan-linked group operating…”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
Copy this indicator · defanged
Thanks — we review every report.