Threat-actor profile

← Back to main site

Home/ Threat Actors/ Transparent Tribe

🇵🇰Transparent Tribe

🇵🇰 Transparent Tribe is a tracked threat actor in the Clankerusecase corpus. Attributed to PK. Primary motivation: State. We map 24 detection use cases to this actor across 29 MITRE ATT&CK techniques, with 1 threat-intel article citing them. Active in our corpus from 2026-08-13 to 2026-08-13.

crit 1

View full actor card → All threat actors MITRE ATT&CK group spec (G0134) ↗

24Use cases

1Articles

29Techniques

3IOCs

Known aliases

Transparent TribeAPT36Mythic LeopardOperation C-MajorCOPPER FIELDSTONEProjectM

Top techniques

T1021.001 · Remote Desktop Protocol T1059.001 · PowerShell T1059.003 · Windows Command Shell

All other tracked techniques

T1027 · Obfuscated Files or Information T1027.002 · Software Packing T1027.013 · Encrypted/Encoded File T1036.005 · Match Legitimate Resource Name or Location T1059.005 · Visual Basic T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution T1204.001 · Malicious Link T1204.002 · Malicious File T1204.004 · Malicious Copy and Paste T1539 · Steal Web Session Cookie T1547.001 · Registry Run Keys / Startup Folder T1547.009 · Shortcut Modification T1555.003 · Credentials from Web Browsers T1564.001 · Hidden Files and Directories T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1568 · Dynamic Resolution T1571 · Non-Standard Port T1583.001 · Domains T1584.001 · Domains T1608.004 · Drive-by Target

Detection use cases (24)

PATCHCORD 'BeaconBrowserHijack' Run-key persistence (APT36) Bespoke PATCHCORD/SHEETCORD browser shortcut (.lnk) hijack write Bespoke PATCHCORD C2 beacon to appstoore.solutions / 46.30.188.13:8080 Bespoke PATCHCORD delivery via TMS_AfghanTelecom.exe Inno Setup installer / known hashes Bespoke SHEETCORD VBS Startup-folder persistence drop Bespoke Beaconing — periodic outbound to small set of destinations Internal Network connections to article IPs / domains Internal Infostealer — non-browser process accessing browser cookie/login DBs Internal Asset exposure — vulnerability matches article CVE(s) Internal Phishing-link click correlated to endpoint execution Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal PowerShell encoded / obfuscated command Internal AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process MITRE match AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay MITRE match Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access MITRE match Package Manager Install Spawning Outbound Egress to Non-Registry Infrastructure Within 5 Minutes MITRE match Package manager lifecycle hook spawns network-fetching shell or runtime MITRE match Service-process parent spawns subprocess containing CLI-argument-injection tokens MITRE match Abnormal Security: malicious email opened MITRE match Click on URL whose host doesn't match the sender domain MITRE match Email attachment opened from external sender MITRE match

Threat-intel articles (1)

crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure · 2026-08-13

Tracked indicators

Domains (2)

appstoore.solutions nic-support.site

IP addresses (1)

46.30.188.13

CVEs (1)

CVE-2024-6387