# Apt36 Transparent Tribe

Adversary-emulation profile for APT36 (G0134 / Transparent Tribe / Mythic Leopard /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt36-transparent-tribe -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt36-transparent-tribe -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt36-transparent-tribe -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt36-transparent-tribe -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT36 (G0134 / Transparent Tribe / Mythic Leopard / ProjectM / COPPER FIELDSTONE), a Pakistan-linked cyber-espionage actor targeting Indian government, defense, and diplomatic entities.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT36 (Transparent Tribe, Mythic Leopard, ProjectM, COPPER FIELDSTONE), Adversary Emulation Profile

APT36 (MITRE ATT&CK **G0134**) is a suspected Pakistan-based cyber-espionage group active since at least **2013**, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan. The group is believed to operate in alignment with Pakistan's Inter-Services Intelligence (ISI) strategic interests, conducting persistent intelligence collection against India's government, military, aerospace, and, more recently, educational and startup sectors. APT36 is characterized by heavy reliance on spearphishing with weaponized Office documents delivering its signature **CrimsonRAT** (.NET implant), Android mobile surveillance via **CapraRAT**, watering hole attacks, social engineering through honey traps and fake personas, and USB-based lateral movement, a pragmatic, high-volume approach tuned for the India-Pakistan geopolitical theater.

## Attribution & motivation

- **Sponsor / nation:** Pakistan, suspected linkage to Inter-Services Intelligence (ISI). Infrastructure analysis has revealed Pakistani Standard Time (`Asia/Karachi`) timezone artifacts embedded in delivered payloads and server configurations.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Pakistani state interests, military, diplomatic, defense-industrial, and political intelligence targeting India. Campaigns consistently exploit India-Pakistan geopolitical events (border tensions, terrorist incidents, Kashmir conflict) as lure themes.
- **Attribution confidence:** **Moderate-High.** Based on consistent multi-vendor reporting (Proofpoint, Kaspersky, Cisco Talos, Trend Micro, BlackBerry, Check Point, CrowdStrike, Secureworks), infrastructure analysis showing Pakistan nexus, and operational patterns sustained over a decade. No formal government indictments, but multiple threat intelligence firms converge on Pakistan-state attribution.

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt36-transparent-tribe/SKILL.md