Operation C-Major — APT Profile

Operation C-Major is the label Trend Micro applied to an information-theft campaign it detailed in March 2016, after researchers David Sancho and Feike Hacquebord found open directories on the attackers' command servers holding some 16 GB taken from 160 people. Most of those records belonged to serving officers of the Indian army, with a foreign military attaché posted to India and a number of IT consultants and resellers also swept up; the haul spanned passport scans and photo IDs, army payslips and tax records, and strategic, tactical and training material. Delivery leaned on tailored email lures carrying weaponised PDFs that triggered an already-dated Adobe Reader exploit to drop an unobfuscated .NET trojan able to log keystrokes, steal passwords, capture audio and grab screenshots, with companion Android spyware aimed at the same officers' phones. Trend Micro judged the tradecraft crude by targeted-attack standards yet effective, and pointed toward Pakistan on the strength of earlier command-server hosting there and repeated VirusTotal rescans of the samples from a single Pakistani account, while stating plainly that nothing connected the activity to Pakistan's government. The cluster now sits inside the Transparent Tribe / APT36 body of work, which MITRE ATT&CK dates to at least 2013 and ties to intrusions against diplomatic, defence and research bodies in India and Afghanistan using Crimson, ObliqueRAT and njRAT.

Tools & malware

Vendor research

Countries linked to this actor

Read the full analysis on IntelFusions