Campaign, Dec 2021 to Jul 2022.View on attack.mitre.org
C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from Transparent Tribe's historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.
| Technique | Procedure example |
|---|---|
| T1059.005 Visual Basic |
For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host. |
| T1204.001 Malicious Link |
During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email. |
| T1204.002 Malicious File |
During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email. |
| T1566.001 Spearphishing Attachment |
During C0011, Transparent Tribe sent malicious attachments via email to student targets in India. |
| T1566.002 Spearphishing Link |
During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India. |
| T1583.001 Domains |
For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India. |
| T1587.003 Digital Certificates |
For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered. |
| T1608.001 Upload Malware |
For C0011, Transparent Tribe hosted malicious documents on domains registered by the group. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
