The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

APT36 (Transparent Tribe) campaigns have been observed delivering CapraRAT (Android) and Crimson RAT (Windows) using Contabo-hosted infrastructure; researchers identified malicious APKs (MD5 hashes provided), a C2 IP (161.97.180.199), and Android permissions consistent with extensive surveillance and credential theft. The report links package name com.moves.media.tubes to prior Transparent Tribe activity, documents high-risk permissions and delivery via social engineering, lists IOCs, and recommends mitigations including app source verification, mobile threat detection, and user awareness.