New year, new sector: Transparent Tribe targets India’s startup ecosystem

Summary

Transparent Tribe (aka APT36) has expanded its spear-phishing activity to target Indian startup companies, with a notable focus on firms offering OSINT and cybersecurity services. The infection chain delivers a malicious ISO that contains a LNK shortcut. When executed, the shortcut triggers a batch stage and ultimately installs Crimson RAT, providing the operators with remote access to the victim system. This shift marks a move beyond the group’s long-standing emphasis on government and defense targets into India’s private-sector startup landscape.

Investigation

The Acronis Threat Research Unit analyzed the ISO payload, embedded LNK shortcut, batch execution logic, and the resulting Crimson RAT implant. Their findings highlight multiple layers of obfuscation, hard-coded C2 details, use of a custom TCP communication protocol, and persistence implemented through a concealed executable placed in the user’s AppData directory. The team also identified infrastructure overlap with prior APT36 operations, including reuse patterns across domains and IP addresses.

Mitigation

Acronis EDR/XDR detections can block the malicious LNK execution path, prevent the batch runner from launching follow-on stages, and disrupt outbound communication to the hard-coded C2 server. Additional defensive steps include preserving Mark of the Web controls (and investigating attempts to remove it), validating file hashes for inbound artifacts, and monitoring for suspicious executable creation in ProgramData or AppData-especially when preceded by ISO mounting and shortcut execution.

Response

If activity is detected, isolate the endpoint, stop the Crimson RAT process, and remove the hidden persisted executable. Perform forensic review of newly created files, registry changes, and any scheduled tasks or startup mechanisms used to maintain access. Reset potentially exposed credentials, notify relevant stakeholders, and update detection content with the extracted IOCs while monitoring for related follow-on activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:
  The adversary has deployed the Crimson RAT binary (a masqueraded executable) on the compromised Windows host. To establish C2, the RAT initiates a custom TCP session to the hard‑coded server 93.127.133.9 on port 12345 (fallback port 54321). PowerShell is used as the launcher to avoid detection by standard process‑creation alerts. The connection persists, allowing the attacker to issue commands via the proprietary protocol.

• Regression Test Script:

  # Crimson RAT C&C simulation – establishes a TCP connection to the malicious IP/port
  $c2Ip   = "93.127.133.9"
  $c2Port = 12345   # primary port; change to 54321 for fallback testing
  
  try {
      Write-Host "[*] Attempting C2 connection to $c2Ip:$c2Port ..."
      $socket = New-Object System.Net.Sockets.TcpClient
      $socket.Connect($c2Ip,$c2Port)
  
      # Send a minimal handshake payload (simulated)
      $stream = $socket.GetStream()
      $payload = [System.Text.Encoding]::ASCII.GetBytes("HELLO`n")
      $stream.Write($payload,0,$payload.Length)
      Write-Host "[+] Handshake sent."
  
      # Keep the connection alive for a short period to ensure logging
      Start-Sleep -Seconds 10
  
      $stream.Close()
      $socket.Close()
      Write-Host "[*] Connection closed."
  } catch {
      Write-Error "Failed to connect to C2: $_"
  }

• Cleanup Commands:

  # Ensure any lingering sockets are closed (defensive cleanup)
  Get-Process -Name "powershell" | Where-Object {$_.StartInfo.FileName -match "TcpClient"} | Stop-Process -Force
  # Remove any temporary files if created (none in this script)