Transparent Tribe

Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.^[2]

Transparent Tribe has crafted VBS-based malicious documents.^[1][2]

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.^[7]

Transparent Tribe has compromised domains for use in targeted malicious campaigns.^[1]

For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.^[7]

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.^[7]

Transparent Tribe has dropped encoded executables on compromised hosts.^[1]

Transparent Tribe has directed users to open URLs hosting malicious content.^[8][3]

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.^[7]

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.^[1][3]

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.^[7]

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.^{[1][2][8][3][6]}

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.^[7]

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.^[2]