Operation C-Major

G0134PK0 reports from 0 vendors

Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.

Vendor aliases (11)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	C-Major
OSINT	Transparent Tribe
OSINT	Mythic Leopard
OSINT	ProjectM
OSINT	APT36
OSINT	APT 36
OSINT	TMP.Lapis
OSINT	Green Havildar
OSINT	COPPER FIELDSTONE
OSINT	Earth Karkaddan
OSINT	Storm-0156

Targeting

Sectors: Civil society, Military, Government, Activists, Civil society, Military

MITRE ATT&CK techniques (14)

T1027.013 T1036.005 T1059.005 T1189 T1203 T1204.001 T1204.002 T1564.001 T1566.001 T1566.002 T1568 T1583.001 T1584.001 T1608.004

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Operation C-Major, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (17)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Operation C-Major. Each row shows why it was linked and where it came from.

Type	Indicator	Linked by	Seen	Source
FileHash-SHA1	1ce6b3f02fe2e4ee201bdab2c1e4f6bb5a8da1b1	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	c544e5d8c6f38bb199283f11f799da8f3bb3807f	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	552e3a16dd36ae4a3d4480182124a3f6701911f2	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	c48a5d639430e08980f1aeb5af49310692f2701b	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	b142e4b75a4562cdaad5cc2610d31594d2ed17c3	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	decf429be7d469292827c3b873f7e61076ffbba1	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	a13568164c0a8f50d76d9ffa6e34e31674a3afc8	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	9288811c9747d151eab4ec708b368fc6cc4e2cb5	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	94c74a9e5d1aab18f51487e4e47e5995b7252c4b	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	24f52c5f909d79a70e6e2a4e89aa7816b5f24aec	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	31ac19091fd5347568b130d7150ed867ffe38c28	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	abcb176578df44c2be7173b318abe704963052b2	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	202f11c5cf2b9df8bf8ab766a33cd0e6d7a5161a	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	f86302da2d38bf60f1ea9549b2e21a34fe655b33	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	16318c4e4f94a5c4018b05955975771637b306b4	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	59aec5002684de8cc8c27f7512ed70c094e4bd20	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX
FileHash-SHA1	6919aa3a9d5e193a1d48e05e7bf320d795923ea7	OTX pulse "Operation C-Major actors used Mobile Spyware Against Targets"	2016-04-18	AlienVault OTX

Public research & publications (20)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

adversary.crowdstrike.comhttps://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/
attack.mitre.orghttps://attack.mitre.org/groups/G0134
blog.talosintelligence.comhttps://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html
securelist.comhttps://securelist.com/transparent-tribe-part-1/98127/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/
proofpoint.comhttps://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf
secureworks.comhttps://www.secureworks.com/research/threat-profiles/copper-fieldstone
documents.trendmicro.comhttp://documents.trendmicro.com/assets/pdf/Indian-military-personnel-targeted-by-information-theft-campaign-cmajor.pdf
amnesty.orghttps://www.amnesty.org/en/documents/asa33/8366/2018/en/
crowdstrike.comhttps://www.crowdstrike.com/blog/adversary-of-the-month-for-may/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe
mkd-cirt.mkhttps://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf
nciipc.gov.inhttps://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf
cysinfo.comhttps://cysinfo.com/cyber-attack-targeting-cbi-and-possibly-indian-army-officials
s.tencent.comhttps://s.tencent.com/research/report/669.html
fireeye.comhttps://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html
trendmicro.comhttps://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html
sentinelone.comhttps://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/
microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/12/04/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage/
reco.aihttps://www.reco.ai/blog/how-apt36-elizarat-redefines-cyber-espionage