Threat actor · all actors
Transparent TribeG0134 state
🇵🇰 PK
aka Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM, Operation C-Major, C-Major, APT 36, TMP.Lapis, Green Havildar, Earth Karkaddan, Storm-0156
Last updated: 2026-08-22
About this actor
[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Microsoftweather-system names
CrowdStrikenation-animal names
Mandiant / genericAPT numbering
Secureworkscolour-metal names
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 23 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2022 — 1 KEV added
- 2010 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2010-3333 KEV | 8.5 | 7.8 | 0.9740 | 2010-11-10 | see CVE |
T1027Obfuscated Files or Information ↗T1027.013Encrypted/Encoded File ↗T1036Masquerading ↗T1036.005Match Legitimate Resource Name or Location ↗T1059Command and Scripting Interpreter ↗T1059.005Visual Basic ↗T1189Drive-by Compromise ↗T1203Exploitation for Client Execution ↗T1204User Execution ↗T1204.001Malicious Link ↗T1204.002Malicious File ↗T1564Hide Artifacts ↗T1564.001Hidden Files and Directories ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1566.002Spearphishing Link ↗T1568Dynamic Resolution ↗T1583Acquire Infrastructure ↗T1583.001Domains ↗T1584Compromise Infrastructure ↗T1584.001Domains ↗T1608Stage Capabilities ↗T1608.004Drive-by Target ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-3 | 15 / 23 | 65% |
SI-4 | 14 / 23 | 61% |
CA-7 | 13 / 23 | 57% |
CM-2 | 12 / 23 | 52% |
CM-6 | 12 / 23 | 52% |
AC-4 | 9 / 23 | 39% |
SC-7 | 9 / 23 | 39% |
SI-2 | 9 / 23 | 39% |
SI-7 | 9 / 23 | 39% |
CM-7 | 8 / 23 | 35% |
SC-44 | 7 / 23 | 30% |
AC-6 | 6 / 23 | 26% |
IA-9 | 6 / 23 | 26% |
SI-10 | 6 / 23 | 26% |
SI-8 | 6 / 23 | 26% |
Co-occurring actors
- Scarlet Mimic 1 shared CVEs
- Aoqin Dragon 1 shared CVEs
- Sandworm Team 1 shared CVEs
- Naikon 1 shared CVEs
Similar actors
Similar TTPs
- Operation Dust Storm 0.52
- C0011 0.42
- Mustard Tempest 0.41
- Elderwood 0.40
- Operation Spalax 0.38
Overlapping CVEs
- Naikon 1.00
- Aoqin Dragon 1.00
- Sandworm Team 0.50
- Scarlet Mimic 0.33
Active in same years
- APT29 2.00
- Naikon 2.00
- Equation 2.00
- Threat Group-3390 2.00
- Scarlet Mimic 2.00
Same nation-state
- Gorgon Group 1.00
- SideCopy 1.00
- DragonForce Pakistan 1.00
- Pakistan Cyber Army 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00