Transparent Tribe Hacker Group Attacking India’s Startup Ecosystem

Transparent Tribe (APT36) has shifted focus to India’s startup ecosystem—especially cybersecurity/intelligence firms—deploying Crimson RAT via ISO attachments (e.g., MeetBisht.iso) that contain a malicious shortcut, decoy document, batch script, and PowerShell chain which installs a hard-linked executable and evades detection through file bloating and randomized code; the malware communicates with hardcoded C2 servers on non-standard ports and can monitor screens, record audio, and exfiltrate files. Recommended mitigations include blocking ISO/container attachments, security awareness training, endpoint detection for suspicious PowerShell and file activity, and network monitoring for unusual outbound connections.