Breaches and incidents
Transparent Tribe / APT36 (India): Pahalgam attack-themed lures deliver Crimson RAT and phish gov.in credentials
Seqrite found PDFs (“Action Points & Response by Govt Regarding Pahalgam Terror Attack.pdf”, “Report Update Regarding Pahalgam Terror Attack.pdf”) created...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Seqrite found PDFs (“Action Points & Response by Govt Regarding Pahalgam Terror Attack.pdf”, “Report Update Regarding Pahalgam Terror Attack.pdf”) created 24 Apr 2025, two days after the attack, linking to fake login pages built to capture @gov.in/@nic.in credentials, plus .ppam add-ins whose macros drop Crimson RAT (22 commands; C2 93.127.133.58).
- Technique: lookalike domains impersonating J&K Police, the Indian Air Force, Army and MoD, many prefixed “email.gov.in” or “nic.in”.
- Attacker: APT36, Pakistan-linked, high confidence per Seqrite.
- Response: IOCs published; macros-off and attachment scanning recommended.