Pakistani APTs Escalate Attacks on Indian Gov. Seqrite Labs Unveils Threats and Connections

Seqrite Labs documents multiple active campaigns (Mar–Apr 2024) by Pakistan-linked APTs SideCopy and Transparent Tribe (APT36) targeting Indian government/defense entities: SideCopy deploys Delphi AllaKore RAT (dual instances) via LNK→MSHTA→HTA chains using compromised domains and Contabo-hosted C2s, while APT36 continues using .NET Crimson RAT variants (including obfuscated/packed builds) via maldocs (XLAM) with base64-embedded payloads; the report provides infection-chain analysis, functionality (recon, keylogging, file ops, exfiltration), extensive IOCs (hashes, domains, IPs, URLs, file paths), infrastructure correlation between groups, and MITRE ATT&CK mappings.