APT36 (Transparent Tribe) Sheet Attack Campaign

APT36FIREPOWERSheetCreepIndia EspionageVibeware

A Pakistan linked threat cluster assessed with medium confidence as APT36 (Transparent Tribe) or a closely aligned sub-group is conducting sustained cyber-espionage against Indian government entities. The latest iteration layers two freshly borrowed Microsoft CVEs (CVE-2026-21509 / CVE-2026-21513) onto an existing delivery chain of weaponized RTF documents and LNK shortcuts, deploying the updated FIREPOWER backdoor against broad Indian targets and dropping a fresh SHEETCREEP build alongside a new CrystalShell-over-Slack variant specifically against a Kashmir-focused target—running Crystal, .NET, and PowerShell toolchains simultaneously from what researchers call a “vibeware factory.”

Indicators of Compromise

Domains (2)

hcidoc.inhciaccounts.in

APT Groups

Operation C-Major

Notes

CONCLUSION<div>The campaign’s most significant development is the rapid adoption of two Microsoft CVEs originally documented against APT28 targets in Europe, now repurposed against Indian government and defense targets. The simultaneous operation of three separate toolchains (Crystal/CrystalShell, .NET/SHEETCREEP, PowerShell/FIREPOWER) against the same target set—with the Kashmir-focused parallel strand running a Slack-exfiltration variant—reflects a deliberate multi-vector hedging strategy. Defenders should treat any unexpected PDF download buttons, LNK shortcuts from emails, and PowerShell callbacks to Firebase or Google Sheets as high-confidence APT36 indicators in the Indian government context.SOCRadar customers can track this campaign via SOCRadar CTI, using IOC Radar for domain/hash hunting, Threat Actor Intelligence for APT36 / Transparent Tribe tracking, and Attack Surface Management to identify exposed government assets.<div> </div></div>

Mitigation

<div style="line-height:1.2;margin-top:0pt;margin-bottom:5pt;">MITIGATION Source: <a href="https://attack.mitre.org/mitigations/enterprise/">attack.mitre.org/mitigations</a></div><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">ID</th><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Mitigation</th><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Recommended Action</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1013/">M1013</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Application Developer Guidance</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Avoid relying on trust signals (zone identifiers, file extensions) that can be bypassed. Developers of document viewers should validate content server-side.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">User Training</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Train staff to treat unexpected PDF “Download Document” buttons and LNK files shared via email as red flags, especially on Indian government networks.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021/">M1021</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Restrict Web-Based Content</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Block downloads of LNK, ZIP, and HTA file types from external sources via web proxy and email gateway. Enforce geo-aware User-Agent controls.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/">M1026</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Use least-privilege accounts that cannot run scheduled tasks or install payloads in ProgramData / Public directories without explicit approval.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028/">M1028</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Operating System Configuration</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Harden Windows Script Host and disable LNK file execution from user download directories where script execution is not required.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Network Intrusion Prevention</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Block or alert on outbound HTTPS to Firebase Realtime Database (*.firebaseio.com), Google Sheets API, and Microsoft Graph API initiated by non-browser processes.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038/">M1038</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Deploy AppLocker or WDAC policies to block PowerShell and cmd.exe spawned from LNK files in %USERPROFILE%\Downloads and %TEMP%.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/">M1040</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Detect .NET assemblies loaded via reflection from reversed byte arrays (byte reversal + Assembly.Load) as used by the SHEETCREEP dropper.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042/">M1042</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Disable or Remove Feature or Program</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Disable Windows Script Host on endpoints that do not require VBScript or LNK-launched scripts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045/">M1045</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Code Signing</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Enforce execution of signed scripts only; block unsigned PowerShell downloaded from C2 via Invoke-RestMethod / iex pipelines.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049/">M1049</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Antivirus/Antimalware</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Ensure AV signatures cover SHEETCREEP (Win32.Backdoor.SHEETCREEP), FIREPOWER (PS.Backdoor.FIREPOWER), and MAILCREEP (Win64.Backdoor.MAILCREEP).</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1050/">M1050</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Exploit Protection</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Apply Microsoft patches for CVE-2026-21509 (MS Office RCE, CVSS 7.8) and CVE-2026-21513 (MSHTML Security Feature Bypass, CVSS 8.8) immediately.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051/">M1051</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Update Software</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Prioritize patching Microsoft Office and Internet Explorer/MSHTML components; both CVEs were weaponized within days of public disclosure.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1054/">M1054</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Software Configuration</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Disable OLE object embedding in Microsoft Office via Group Policy (Disable all with notification) to mitigate CVE-2026-21509 RTF/OLE exploitation.</td></tr></tbody></table></div>