Transparent Tribe Expands Espionage Campaign to Target India’s Startup Ecosystem The Pakistan-linked threat group Transparent Tribe (APT36), known for cyberespionage against Indian government and defense sectors since 2013, has shifted tactics to infiltrate India’s startup ecosystem. Researchers at Acronis uncovered a new campaign leveraging spear-phishing emails to deploy the Crimson RAT malware, specifically targeting startups in OSINT (Open Source Intelligence) and cybersecurity sectors with ties to government and law enforcement agencies. The attack begins with a malicious ISO file ("MeetBisht.iso") disguised as a legitimate meeting request, referencing Voldebug, a real Indian startup, and its founder. When opened, the file displays a decoy Excel shortcut (LNK file), which executes a hidden batch script while showing a fake document to distract the victim. This triggers the installation of Crimson RAT, a 34MB Remote Access Trojan artificially inflated with "garbage data" to evade antivirus detection by exploiting size-based scanning limitations. Once active, the malware grants attackers full control over the infected system, including: - Surveillance: Screen recording, webcam/microphone activation. - Data theft: File enumeration, exfiltration of sensitive documents. - System manipulation: Process termination, command execution. The RAT communicates with its command-and-control (C2) server via a custom TCP protocol, making network traffic harder to detect. Acronis researchers attributed the attack to Transparent Tribe with high confidence, citing reused infrastructure (including U.S.-hosted servers) and code overlaps with past campaigns. A notable misspelling ("Evidance" instead of "Evidence") in file names further linked the operation to the group’s previous activities. This campaign highlights a supply-chain-style espionage strategy: by compromising startups with government connections, Transparent Tribe gains indirect access to sensitive state data. The shift underscores the growing threat to private-sector entities collaborating with public institutions, positioning them as high-value targets in state-sponsored cyber operations.