Transparent Tribe Launches New RAT Campaign Targeting Indian Government and Academic Networks

Transparent Tribe (APT36) is conducting a targeted espionage campaign against Indian government agencies, academic institutions, and strategic research organizations using socially engineered spear-phishing archives containing LNK shortcuts that launch HTA via mshta.exe to load a memory-resident DLL RAT. The malware enables long-term covert access (command execution, file exfiltration, screenshots, clipboard monitoring), uses adaptive persistence techniques and living-off-the-land binaries to evade detection, and communicates with HTTP-based C2 servers; although some C2 servers appear inactive, persistence on compromised hosts poses a continued reactivation risk.