Operation C-Major (Transparent Tribe, APT36) is a Pakistan-based cyber espionage group targeting Indian military entities.
Operation C-Major (Transparent Tribe, APT36) is a Pakistan-based nation-state cyber espionage group. It primarily targets Indian military and government entities, as well as activists and civil society within Pakistan. The group gains initial access via spearphishing links and drive-by compromise, deploying commodity RATs like DarkComet, njRAT, and ObliqueRAT, while using dynamic DNS for C2 resolution. Defenders should focus on email filtering, blocking VBA macros, and monitoring suspicious domain registrations and drive-by download attempts.
Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.
Monitor network traffic for suspicious domain registrations and drive-by attacks, and identify anomalous domain behavior.
Implement user education and web traffic monitoring to defend against drive-by compromise and spearphishing link attacks.
Configure endpoint detection and prevention systems to detect and block Visual Basic scripts and malicious file execution.
Implement file system monitoring and behavioral analysis to detect encrypted/encoded files and files matching legitimate resource names.
Analyze network traffic to detect dynamic resolution techniques and implement DNS traffic monitoring.
Operation C-Major is a Pakistan-based nation-state cyber espionage group. It primarily targets Indian military and government entities, as well as activists and civil society within Pakistan.
Operation C-Major gains initial access via spearphishing links and drive-by compromise.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.