Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Operation C-Major · Nation-state · assessed origin Pakistan · misp-galaxy + mitre-attack · refreshed 2026-10-06

Operation C-Major

  • C-Major
  • Transparent Tribe
  • Mythic Leopard
  • ProjectM
  • APT36
  • APT 36
  • TMP.Lapis
  • Green Havildar

state sponsor · PakistanMITRE G0134 ↗

Operation C-Major — ATT&CK roseOC

attack rose · 14 techniques across 5 tactics

Last 30 days

last seen 29 d ago
dispatch1
victims0
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2010-3333, CVE-2012-0158
  2. —29 d agoresurfacedback on the wire after 28 quiet days

Analyst brief

misp-galaxy + mitre-attack

Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.

Observed targets (as stated by the sources)

0 countries · 4 sectors
Assessed origin: Pakistan

assessed origin · Pakistanobserved targets · 0

sectors · 4

  • Civil society
  • Military
  • Government
  • Activists

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

14 techniques · 5 of 15 tactics

  1. Resource development

    3 techniques

  2. Initial access

    3 techniques

  3. Execution

    4 techniques

  4. Stealth

    3 techniques

  5. Command and control

    1 technique

select a technique

Arsenal

5 malware
Malware
Malware · 5ATT&CK
DarkCometS0334 ↗
ObliqueRATS0644 ↗
njRATS0385 ↗
CrimsonS0115 ↗
PeppyS0643 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Operation C-Major is cited as exploiting

none on KEV
  1. CVE-2010-33332026-10-17
    1. “Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2012-01582026-10-17
    1. “Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Analysis of APT-C-56 (Transparent Tribe) camouflage resume attack campaignCoreSec360 ↗
  2. 2022Transparent Tribe campaign uses new bespoke malware to target Indian government officialsCisco ↗
  3. 2020Transparent Tribe: Evolution analysis, part 1Kaspersky ↗
  4. 2020Transparent Tribe: Evolution analysis, part 2Kaspersky ↗
  5. 2016Operation Transparent TribeProofpoint ↗
  6. 2016Operation C-Major Actors Also Used Android BlackBerry Mobile Spyware Against TargetsTrend Micro ↗

Take it with you

keyless · no signup

References

20 sources
  1. 1.documents.trendmicro.com/assets/pdf/Indian-military-personnel-targeted-by-infor…
  2. 2.proofpoint.com/sites/default/files/proofpoint-operation-transparent-t…
  3. 3.amnesty.org/en/documents/asa33/8366/2018/en
  4. 4.crowdstrike.com/blog/adversary-of-the-month-for-may
  5. 5.unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and…
  6. 6.mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-M…
  7. 7.nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf
  8. 8.cysinfo.com/cyber-attack-targeting-cbi-and-possibly-indian-army-of…
  9. 9.s.tencent.com/research/report/669.html
  10. 10.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html
  11. +10 more in the JSON record

Track Operation C-Major on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.