^[4]

^[3]

^[5][2][3]

^[6][2]

^[7]

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.^[1][3]

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.^[7]

Transparent Tribe has crafted VBS-based malicious documents.^[1][2]

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.^[7]

Transparent Tribe has compromised domains for use in targeted malicious campaigns.^[1]

For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.^[7]

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.^[1][6][3]

Transparent Tribe has used dynamic DNS services to set up C2.^[1]

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.^[1]

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.^[2]

Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.^[2]

Transparent Tribe has dropped encoded executables on compromised hosts.^[1]

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.^{[1][2][8][3][6]}

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.^[7]

Transparent Tribe has embedded links to malicious downloads in e-mails.^[8][3]

During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.^[7]

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.^[7]

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.^[1][6][3]

Transparent Tribe has directed users to open URLs hosting malicious content.^[8][3]

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.^[7]

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.^{[1][2][8][3][6]}

During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.^[7]