Transparent Tribe

Overview

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.

Naming & attribution

Transparent Tribe is tracked under 5 names across the industry. It uses 14 documented ATT&CK techniques — more than 40% of the 174 groups tracked here. Activity attributed since at least 2013.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Elderwood China — 7 shared techniques (44% overlap)
• Machete — 7 shared techniques (39% overlap)
• Mofang China — 5 shared techniques (33% overlap)
• Mustard Tempest — 6 shared techniques (30% overlap)
• TA2541 — 9 shared techniques (27% overlap)
• TA459 China — 4 shared techniques (27% overlap)

Targets

Activists · Civil society · Government · Military

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 14 techniques across 5 tactics

Tools & malware (5)

DarkComet · ObliqueRAT · njRAT · Crimson · Peppy

Reporting (3)

• Transparent Tribe APT expands its Windows malware arsenal — Malhotra, A. et al
• Transparent Tribe: Evolution analysis, part 1 — Dedola, G
• ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe — Falcone, R. and Conant S