Operation C-Major
Also known as C-Major, Transparent Tribe, Mythic Leopard, ProjectM, APT36, APT 36, TMP.Lapis, Green Havildar, COPPER FIELDSTONE, Earth Karkaddan, Storm-0156
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.
Targets: Civil society, Military, Government
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1059.005 Visual BasicT1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1564.001 Hidden Files and DirectoriesT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1568 Dynamic ResolutionT1583.001 DomainsT1584.001 DomainsT1608.004 Drive-by Target
Recent activity
No posts or advisories have named this actor recently.
References
- http://documents.trendmicro.com/assets/pdf/Indian-military-personnel-targeted-by-information-theft-campaign-cmajor.pdf
- https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf
- https://www.amnesty.org/en/documents/asa33/8366/2018/en/
- https://www.crowdstrike.com/blog/adversary-of-the-month-for-may/
- https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe
- https://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf
- https://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf
- https://cysinfo.com/cyber-attack-targeting-cbi-and-possibly-indian-army-officials
- https://s.tencent.com/research/report/669.html
- https://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone
- https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.