Transparent Tribe

Also known as: COPPER FIELDSTONE · APT36 · Mythic Leopard · ProjectM

Overview

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.

Naming & attribution

Transparent Tribe is tracked under 5 names across the industry. It uses 14 documented ATT&CK techniques — more than 40% of the 174 groups tracked here. Activity attributed since at least 2013.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
COPPER FIELDSTONE	Secureworks
APT36	Malhotra, A. et al
Mythic Leopard	Crowdstrike
ProjectM	Falcone, R. and Conant S

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Elderwood China — 7 shared techniques (44% overlap)
Machete — 7 shared techniques (39% overlap)
Mofang China — 5 shared techniques (33% overlap)
Mustard Tempest — 6 shared techniques (30% overlap)
TA2541 — 9 shared techniques (27% overlap)
TA459 China — 4 shared techniques (27% overlap)

Malware families with tracked indicators

One family attributed to Transparent Tribe, with 74 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

DarkComet 74 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Activists · Civil society · Government · Military

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1203
Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 14 techniques across 5 tactics

Resource Development

T1583.001 Domains
T1584.001 Domains
T1608.004 Drive-by Target

Initial Access

Tools & malware (5)

DarkComet · ObliqueRAT · njRAT · Crimson · Peppy

Reporting (3)

Transparent Tribe APT expands its Windows malware arsenal — Malhotra, A. et al
Transparent Tribe: Evolution analysis, part 1 — Dedola, G
ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe — Falcone, R. and Conant S