Pakistan-linked hackers hit the Indian education sector
The attacks are part of a previously reported broader targeting of the education sector by Transparent Tribe.
Transparent Tribe (also known as APT36), a Pakistan-linked cyber threat group, has been found targeting the education sector in India, notably with the CrimsonRAT malware.
Transparent Tribe is reported to be distributing education-related malicious documents, purportedly related to student assignments, as attachments to phishing emails. The malicious documents open the door to CrimsonRAT, which uses both Microsoft Office macro and OLE embeds to lure victims into downloading malicious content. Disguised as an update process, CrimsonRAT is then executed.
Transparent Tribe has been targeting Indian military and defence personnel since 2013. In 2022, SentinelOne reported that the group has started targeting the Indian educational sector.
About author
DW Team
The GIP Digital Watch Observatory team, consisting of over 30 digital policy experts from around the world, excels in the fields of research and analysis on digital policy issues. The team is backed by the creative prowess of Creative Lab Diplo and the technical expertise of the Diplo tech team.