Transparent Tribe G0134

Overview 7,811 indicators

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.

Techniques 14 ATT&CK

Open in ATT&CK Navigator → or download the layer (14 techniques, layer 4.5)

• T1027.013 Encrypted/Encoded File
• T1036.005 Match Legitimate Resource Name or Location
• T1059.005 Visual Basic
• T1189 Drive-by Compromise
• T1203 Exploitation for Client Execution
• T1204.001 Malicious Link
• T1204.002 Malicious File
• T1564.001 Hidden Files and Directories
• T1566.001 Spearphishing Attachment
• T1566.002 Spearphishing Link
• T1568 Dynamic Resolution
• T1583.001 Domains
• T1584.001 Domains
• T1608.004 Drive-by Target

Software 5

• Crimson
• DarkComet
• njRAT
• Peppy
• ObliqueRAT

Principal sources 1,103 reports

Ranked by how many of this actor's indicators each report brought in.

• 2,433x.com/SinghSoodeep/status/2031326993455755618
• 2,433virustotal.com/gui/file/8587a778e3bae0fb664e598bcc54eb…
• 483x.com/PrakkiSathwik/status/1979514409551819168
• 449app.validin.com/detail?find=8d46b0ef0d23f1d5c0c21f88d48…
• 401x.com/Malwarehunterr/status/20734652178882234…
• 377app.validin.com/lookalikes?limit=1000&lookback=90&depth…
• 321x.com/TIntel2255/status/1899796191950377237
• 201x.com/solostalking/status/1935222291375472707

Related groups 5

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Sidewinder G0121
  4 shared indicators · 2 reports cite both
• Patchwork G0040
  3 shared indicators
• SIMBAA
  1 shared indicator
• UNCLASSIFIED
  1 report cite both
• APT38 G0082
  shares DarkComet

Timeline 7,811 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 7,811. Complete: G0134.json.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-08-03 264 domainthis year

   x.com/PrakkiSathwik/status/1979514409551819168

   crsorgi.gov.in.indexs.eu.cc

   crsverify.com

   crsweb.xyz

   cscdigital.xyz

   cscinto.cfd

   csssuu.cfd

   csucc.cfd

   csuccc.cfd

   dc.crsorgi.gov.in.indexs.eu.cc

   dcoriginal.online

   dfone.shop

   dgct.site

   ditasol.xyz

   edgeworking.shop

   emitra.cam

   freshseva.icu

   gfh.wtf

   gov.in.aadharsewa.site

   gov.in.aadperson.xyz

   gov.in.amrjeetservicenet.xyz

   gov.in.apie.live

   gov.in.apiwala.space

   gov.in.apnacsc.xyz

   gov.in.apnafind.shop

   gov.in.ardhsanikcanteen.in

   gov.in.authxweb.in

   gov.in.bestadhaarprint.in

   gov.in.bestonline.digital

   gov.in.bestprint.cfd

   gov.in.bhawishyanidhi.in

   gov.in.certifly.live

   gov.in.certview.in

   gov.in.certviw.in

   gov.in.crasverify.cfd

   gov.in.crgi.shop

   gov.in.crgi.xyz

   gov.in.crs.wtf

   gov.in.crsa.site

   gov.in.crsapna.shop

   gov.in.crsmitra.xyz

   gov.in.crso.site

   gov.in.crsor.info

   gov.in.crsorgin.xyz

   gov.in.crsverify.com

   gov.in.crsweb.xyz

   gov.in.cscdigital.xyz

   gov.in.cscinto.cfd

   gov.in.csssuu.cfd

   gov.in.csucc.cfd

   gov.in.csuccc.cfd

   gov.in.dcoriginal.online

   gov.in.dcrs.in

   gov.in.dfone.shop

   gov.in.dgct.site

   gov.in.ditasol.xyz

   gov.in.edgeworking.shop

   gov.in.emitra.cam

   gov.in.freshseva.icu

   gov.in.gfh.wtf

   gov.in.govaco.shop

   gov.in.gove.info

   gov.in.govindia.in

   gov.in.gstech.cam

   gov.in.indexin.shop

   gov.in.indexphp.info

   gov.in.indexs.eu.cc

   gov.in.indexx.store

   gov.in.indxe.info

   gov.in.irxi.in

   gov.in.jantaweb.site

   gov.in.livereport.icu

   gov.in.lndex.online

   gov.in.ncrs.fun

   gov.in.ogri.site

   gov.in.omsaicomputerucl.site

   gov.in.orgi.online

   gov.in.orjinaal.xyz

   gov.in.orroi.shop

   gov.in.pdfn.site

   gov.in.photosupload.xyz

   gov.in.phptt.online

   gov.in.portalwalamanual.shop

   gov.in.printhh.shop

   gov.in.procrs.site

   gov.in.rkprint.xyz

   gov.in.royalservice.shop

   gov.in.serviscart.shop

   gov.in.sscrs.site

   gov.in.txprint.xyz

   gov.in.veerrajput.xyz

   gov.in.vefiy.in

   gov.in.vefry.in

   gov.in.verfiys.in

   gov.in.verfly.in

   gov.in.verfry.in

   gov.in.verfy.cc

   gov.in.verifycert.shop

   gov.in.verifycertificate.biz

   gov.in.verifycertificate.site

   gov.in.verifyd.xyz

   gov.in.verifyinfo.xyz

   gov.in.verifyy.in

   gov.in.veriy.in

   gov.in.veriye.in

   gov.in.verlfy.online

   gov.in.viaw.in

   gov.in.viewcert.buzz

   gov.in.viewcerts.fun

   gov.in.viewd.in

   gov.in.vkbestprint.com

   gov.in.vlewcert.shop

   gov.in.webl.info

   gov.in.webxcoder.sbs

   govaco.shop

   gove.info

   govindia.in

   gstech.cam

   in.aadharsewa.site

   in.aadperson.xyz

   in.amrjeetservicenet.xyz

   in.apie.live

   in.apiwala.space

   in.apnacsc.xyz

   in.apnafind.shop

   in.ardhsanikcanteen.in

   in.authxweb.in

   in.bestadhaarprint.in

   in.bestonline.digital

   in.bestprint.cfd

   in.bhawishyanidhi.in

   in.certifly.live

   in.certview.in

   in.certviw.in

   in.crasverify.cfd

   in.crgi.shop

   in.crgi.xyz

   in.crs.wtf

   in.crsa.site

   in.crsapna.shop

   in.crsmitra.xyz

   in.crso.site

   in.crsor.info

   in.crsorgin.xyz

   in.crsverify.com

   in.crsweb.xyz

   in.cscdigital.xyz

   in.cscinto.cfd

   in.csssuu.cfd

   in.csucc.cfd

   in.csuccc.cfd

   in.dcoriginal.online

   in.dcrs.in

   in.dfone.shop

   in.dgct.site

   in.ditasol.xyz

   in.edgeworking.shop

   in.emitra.cam

   in.freshseva.icu

   in.gfh.wtf

   in.govaco.shop

   in.gove.info

   in.govindia.in

   in.gstech.cam

   in.indexin.shop

   in.indexphp.info

   in.indexs.eu.cc

   in.indexx.store

   in.indxe.info

   in.irxi.in

   in.jantaweb.site

   in.livereport.icu

   in.lndex.online

   in.ncrs.fun

   in.ogri.site

   in.omsaicomputerucl.site

   in.orgi.online

   in.orjinaal.xyz

   in.orroi.shop

   in.pdfn.site

   in.photosupload.xyz

   in.phptt.online

   in.portalwalamanual.shop

   in.printhh.shop

   in.procrs.site

   in.rkprint.xyz

   in.royalservice.shop

   in.serviscart.shop

   in.sscrs.site

   in.txprint.xyz

   in.veerrajput.xyz

   in.vefiy.in

   in.vefry.in

   in.verfiys.in

   in.verfly.in

   in.verfry.in

   in.verfy.cc

   in.verifycert.shop

   in.verifycertificate.biz

   in.verifycertificate.site

   in.verifyd.xyz

   in.verifyinfo.xyz

   in.verifyy.in

   in.veriy.in

   in.veriye.in

   in.verlfy.online

   in.viaw.in

   in.viewcert.buzz

   in.viewcerts.fun

   in.viewd.in

   in.vkbestprint.com

   in.vlewcert.shop

   in.webl.info

   in.webxcoder.sbs

   indexphp.info

   indexs.eu.cc

   indexx.store

   indxe.info

   irxi.in

   jantaweb.site

   livereport.icu

   lndex.online

   ncrs.fun

   ogri.site

   omsaicomputerucl.site

   orgi.online

   orjinaal.xyz

   orroi.shop

   pdfn.site

   photosupload.xyz

   phptt.online

   portalwalamanual.shop

   printhh.shop

   procrs.site

   rkprint.xyz

   royalservice.shop

   sci.mhgv.in

   serviscart.shop

   sscrs.site

   temp.sci.nic.in

   txprint.xyz

   veerrajput.xyz

   vefiy.in

   vefry.in

   verfiys.in

   verfly.in

   verfry.in

   verfy.cc

   verifycert.shop

   verifycertificate.biz

   verifycertificate.site

   verifyd.xyz

   verifyinfo.xyz

   verifyy.in

   veriy.in

   veriye.in

   verlfy.online

   viaw.in

   viewcert.buzz

   viewcerts.fun

   viewd.in

   vkbestprint.com

   vlewcert.shop

   webl.info

   webxcoder.sbs

   copy batch

2. 2026-08-03 15 domainthis year

   x.com/Malwarehunterr/status/20734652178882234…

   crsorgi.gov.in.crs.crsverfy.in

   crsorgi.gov.in.verifiys.id

   crsorgi.gov.in.veriy.eu.cc

   crsverfy.in

   dc.crsorgi.gov.in.crs.crsverfy.in

   dc.crsorgi.gov.in.verifiys.id

   dc.crsorgi.gov.in.veriy.eu.cc

   gov.in.crs.crsverfy.in

   gov.in.verifiys.id

   gov.in.veriy.eu.cc

   in.crs.crsverfy.in

   in.verifiys.id

   in.veriy.eu.cc

   verifiys.id

   veriy.eu.cc

   copy batch

3. 2026-08-03 13 domainthis year

   x.com/skocherhan/status/2066130507427983633

   aidigitalseva.top

   birt.club

   birthportal.life

   crsorgi.gov.in.aidigitalseva.top

   crsorgi.gov.in.viewscert.info

   dc.crsorgi.gov.in.aidigitalseva.top

   dc.crsorgi.gov.in.viewscert.info

   dccrsorgishop.site

   gov.in.aidigitalseva.top

   gov.in.viewscert.info

   in.aidigitalseva.top

   in.viewscert.info

   viewscert.info

   copy batch

4. 2026-07-24 5 domain, 1 ipv4, 3 url_paththis year

   x.com/goldenjackel12/status/20805278484321486… · x.com/goldenjackel12/status/20805290139243890… · virustotal.com/gui/file/67bbed4c71f93013910a8443fd92f4…

   domain	8a.monitorondomainlintgt.store
   domain	9z.monitorondomainwintgt2.store
   domain	monitorondomainlintgt.store
   domain	monitorondomainwintgt2.store
   domain	vitrinedasabedoria.com.br
   ipv4	173.225.99.250:15500
   url_path	/api/coach-instructions?client_id=
   url_path	/api/exercise-download?exercise=

   copy batch · 1 more in this batch, in the JSON

Further reading 1,107

• adversary.crowdstrike.com/en-US/adversary/mythic-leopard
• attack.mitre.org/groups/G0134
• blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-tar…
• securelist.com/transparent-tribe-part-1/98127
• unit42.paloaltonetworks.com/unit42-projectm-link-found-between-paki…
• proofpoint.com/sites/default/files/proofpoint-operatio…
• secureworks.com/research/threat-profiles/copper-fieldst…
• twitter.com/PrakkiSathwik/status/1770447142357741737
• twitter.com/MichalKoczwara/status/17744542260448177…
• app.validin.com/detail?type=ip&find=145.223.103.223#tab…
• virustotal.com/gui/file/bd5bad8ae151d32347eb6b06ee28f8…
• virustotal.com/gui/file/33feaee2039e28e252f7289ba9fc87…
• virustotal.com/gui/file/80b4b7b1f00d869958e18f5f1d8096…
• x.com/okx_VFJ_/status/1954193713321668867
• x.com/PrakkiSathwik/status/1935349973404762509
• x.com/PrakkiSathwik/status/1990738847844470844
• virustotal.com/gui/file/396a46e9595fe6bdae709ab3171900…
• cyberproof.com/blog/cyber-attacks-rise-as-tension-moun…
• x.com/PrakkiSathwik/status/1833113297278644602
• virustotal.com/gui/file/10650a3376a1db207e07697f58e906…
• mp.weixin.qq.com/s/QD_MYIYivM_S1dr4vZxocg
• virustotal.com/gui/file/fdb2804a394065df893c95d8fed789…
• virustotal.com/gui/file/499f16ed2def90b3d4c0de5ca22d8c…
• virustotal.com/gui/file/71bbf2394fe4909a6ce0f7085ca41f…
• app.validin.com/detail?find=eb3f429628466bffb76bd984834…
• sentinelone.com/labs/capratube-remix-transparent-tribes…
• twitter.com/ShadowChasing1/status/14909880273546485…
• twitter.com/0xrb/status/1491665998382247938
• virustotal.com/gui/file/50f30b78df1a225d9f99d036a8109d…
• virustotal.com/gui/ip-address/111.90.156.191/relations
• virustotal.com/gui/file/8941dead07922712a56bc8a8917146…
• twitter.com/StopMalvertisin/status/1677317772072693…
• app.any.run/tasks/9ca972d6-3574-4d85-bd68-a9cd26c20…
• twitter.com/PrakkiSathwik/status/1733923613437460525
• virustotal.com/gui/file/67386fad18d548de90d13095d273de…
• virustotal.com/gui/file/8c158a09ac554f4fa161c75e72bb17…
• virustotal.com/gui/file/851b97f5419f3735f872eb59a12ca7…
• virustotal.com/gui/file/7d834e9caaaadd4f7e43777873550d…
• virustotal.com/gui/file/cffb0b0695abe36c0d23894650214f…
• x.com/Cyberteam008/status/1806529081732694202

1,067 more, and the report behind every indicator, in G0134.json.