Breaches and incidents
Transparent Tribe / APT36 (India): Crimson RAT spear-phishing shifts to Indian OSINT and cybersecurity startups
Acronis TRU reported APT36 targeting staff of Indian startups, especially OSINT and cybersecurity firms near government and law-enforcement work, using a...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Acronis TRU reported APT36 targeting staff of Indian startups, especially OSINT and cybersecurity firms near government and law-enforcement work, using a decoy built around a real founder’s name.
- Technique: email with MeetBisht.iso containing “Meet Bisht.xlsx.lnk”; a batch file shows an XLSX decoy, copies files to C:\ProgramData, strips Mark of the Web with PowerShell, hard-links and runs the payload; Crimson RAT padded to 34 MB to evade scanning; C2 93.127.133.9.
- Attacker: Transparent Tribe, high confidence per Acronis.
- Response: IOCs published.