Individual skill
apt36-transparent-tribe
Adversary-emulation profile for APT36 (G0134 / Transparent Tribe / Mythic Leopard / ProjectM / COPPER FIELDSTONE), a Pakistan-linked cyber-espionage actor targeting Indian government, defense, and diplomatic entities.
packages/decepticon/decepticon/skills/shared/adversary-emulation/apt36-transparent-tribe/SKILL.md
Source commit cc6044561ff32188dc0aa899bcc7d3666ffcfd1c
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 2, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 6,563
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- cybersecurity Repository topic
- hacking Repository topic
- langchain Repository topic
- langgraph Repository topic
- llm Repository topic
- generative-ai Repository topic
- pentesting Repository topic
- pentest Repository topic
- engineering Derived category
Declared tags are partial or unavailable.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 24,660 bytes
Read excerpt
# APT36 (Transparent Tribe, Mythic Leopard, ProjectM, COPPER FIELDSTONE) — Adversary Emulation Profile
APT36 (MITRE ATT&CK **G0134**) is a suspected Pakistan-based cyber-espionage group active since at least **2013**, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan. The group is believed to operate in alignment with Pakistan's Inter-Services Intelligence (ISI) strategic interests, conducting persistent intelligence collection against India's government, military, aerospace, and — more recently — educational and startup sectors. APT36 is characterized by heavy reliance on spearphishing with weaponized Office documents delivering its signature **CrimsonRAT** (.NET implant), Android mobile surveillance via **CapraRAT**, watering hole attacks, social engineering through honey traps and fake personas, and USB-based lateral movement — a pragmatic, high-volume approach tuned for the India-Pakistan geopolitical theater.
## Attribution & motivation
- **Sponsor / nation:** Pakistan — suspected linkage to Inter-Services Intelligence (ISI). Infrastructure analysis has revealed Pakistani Standard Time (`Asia/Karachi`) timezone artifacts embedded in delivered payloads and server configurations.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with Pakistani state interests — military, diplomatic, defense-industrial, and political intelligence targeting India. Campaigns consistently exploit India-Pakistan geopolitical events (border tensions, terrorist incidents, Kashmir conflict) as lure themes.
- **Attribution confidence:** **Moderate-High.** Based on consistent multi-vendor reporting (Proofpoint, Kaspersky, Cisco Talos, Trend Micro, BlackBerry, Check Point, CrowdStrike, Secureworks), infrastructure analysis showing Pakistan nexus, and operational patterns sustained over a decade. No formal government indictments, but multiple threat intelligence firms converge on Pakistan-state attribution.
## Targeting
- **Sectors:** Government and diplomatic bodies; defense, military, and aerospace (including Department of Defense Production and state-owned defense electronics firms); research and academic institutions (Indian universities and students since 2022); startups and technology firms (since 2025); NGOs and social activists.
- **Regions:** Heavily focused on **India** — the primary target across all campaigns. Secondary targeting of **Afghanistan** and other South Asian nations. Occasional activity against Pakistani dissidents and social activists.