An actor known as APT36 (Transparent Tribe) has been observed targeting the Indian education sector with malicious Office documents distributing the Crimson RAT.
The group has been active since at least 2013, but has now moved from targeting Indian military and government officials to sabotaging educational institutions, according to new recommendations from SentinelOne.
Senior Threat Researcher at SentinelLabs Aleksandar Milenkoski writes:
According to the technical article, the name and content of the lure document and the associated domain and use of the Crimson RAT indicate that recent activity observed by SentinelOne is part of a campaign previously reported by Transparent Tribe. suggests.
Read more about the Transparent Tribe here: Officials Targeted by Romance Scams and Android Trojans
“Documents distributed by Transparent Tribe have educational content and titles,” the recommendation reads. “Based on the known behavior of this group, the document may have been distributed to targets as attachments in phishing emails.”
SentinelOne explained that the team observed several Crimson RAT .NET implementations with timestamps from July to September 2022.
“Crimson RAT variants implement various obfuscation techniques of varying strength, including simple function name malformations and dynamic string resolution,” wrote Milenkoski.
Crimson RAT is able to steal system information, capture screenshots, start and stop processes, and enumerate files and drives.
“Transparent Tribe is a highly motivated and relentless threat actor who regularly updates its malware arsenal, operational strategies, and targets,” warns SentinelOne.
Case in point, in these campaigns APT36 employed Microsoft’s Object Linking & Embedding (OLE) as a technique for embedding malware from decoy documents. We also used the Eazfuscator obfuscator to protect our implementation of the Crimson RAT.
“The Transparent Tribe’s ever-changing operational and targeting strategies require constant vigilance to mitigate the threat posed by this group,” concluded Milenkoski.
Meta took action against the APT36 attacker last year.
