Pakistan’s Transparent Tribe Cyber Espionage Campaign Escalates in Afghanistan and India
A sophisticated nation-state threat actor has been conducting a relentless cyber espionage campaign against high-value targets in Afghanistan, with some attempts also aimed at government agencies in India. The threat actor, known as Transparent Tribe (aka APT 36), is believed to be operating on behalf of the Pakistani state, according to researchers who have been tracking its activities.
Transparent Tribe has been using a novel malware toolset, including backdoors called “Patchcord” and “Sheetcord”, which are designed to evade detection and allow for remote control of infected systems. One of the most notable features of Patchcord is its ability to execute arbitrary code in-memory, making it a powerful tool for conducting cyber espionage. However, this approach also makes it more detectable by security software, raising questions about the group’s intentions.
The campaign has been ongoing since at least December 2025, with a significant increase in activity observed in May of this year. Targets in Afghanistan have included major government and telecommunications organizations, as well as smaller businesses and individuals. In India, the group has attempted to compromise government agencies, including ministries and military units, although no successful breaches have been confirmed.
Researchers have identified phishing lures used by Transparent Tribe that impersonate legitimate software tools and resources, such as network management software and government employee benefits platforms. The C2 domains used by the group also mimic major Indian government organizations and Afghan telecoms, further blurring the lines between reality and deception.
The ultimate goal of this campaign is likely to gather sensitive information about targets in Afghanistan and India, which could be used for a variety of purposes, including intelligence gathering or even future attacks. The fact that Transparent Tribe has been targeting smaller businesses and individuals in addition to major government agencies highlights its willingness to adapt and exploit any vulnerability.
The failure of Transparent Tribe’s attempts against Indian government agencies may indicate that the group is still learning about the security measures in place, or it could be a deliberate attempt to test defenses. Either way, this campaign serves as a reminder of the ongoing threat posed by nation-state actors in the region and the importance of robust cybersecurity measures for all organizations.
So what can you do to protect yourself from similar threats? First and foremost, stay up-to-date with security patches and updates on your systems and software. Be cautious when clicking on links or downloading attachments from unknown sources, as these are often used to spread malware like Patchcord. Implement robust antivirus software that includes advanced threat detection capabilities, and consider using a virtual private network (VPN) to encrypt your internet traffic. By taking these simple steps, you can significantly reduce the risk of falling victim to cyber espionage campaigns like Transparent Tribe’s.
Source: Dark Reading — 2026-08-20