APT36 (Transparent Tribe, Mythic Leopard, ProjectM, COPPER FIELDSTONE), Adversary Emulation Profile

APT36 (MITRE ATT&CK G0134) is a suspected Pakistan-based cyber-espionage group active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan. The group is believed to operate in alignment with Pakistan's Inter-Services Intelligence (ISI) strategic interests, conducting persistent intelligence collection against India's government, military, aerospace, and, more recently, educational and startup sectors. APT36 is characterized by heavy reliance on spearphishing with weaponized Office documents delivering its signature CrimsonRAT (.NET implant), Android mobile surveillance via CapraRAT, watering hole attacks, social engineering through honey traps and fake personas, and USB-based lateral movement, a pragmatic, high-volume approach tuned for the India-Pakistan geopolitical theater.

Attribution & motivation

• Sponsor / nation: Pakistan, suspected linkage to Inter-Services Intelligence (ISI). Infrastructure analysis has revealed Pakistani Standard Time (Asia/Karachi) timezone artifacts embedded in delivered payloads and server configurations.
• Motivation: Primarily strategic intelligence collection (espionage) aligned with Pakistani state interests, military, diplomatic, defense-industrial, and political intelligence targeting India. Campaigns consistently exploit India-Pakistan geopolitical events (border tensions, terrorist incidents, Kashmir conflict) as lure themes.
• Attribution confidence: Moderate-High. Based on consistent multi-vendor reporting (Proofpoint, Kaspersky, Cisco Talos, Trend Micro, BlackBerry, Check Point, CrowdStrike, Secureworks), infrastructure analysis showing Pakistan nexus, and operational patterns sustained over a decade. No formal government indictments, but multiple threat intelligence firms converge on Pakistan-state attribution.