Tranchulas

A ThreatConnect blog reports on a South Asia cyber espionage campaign that employed custom malware and decoy documents to target Indian military and government entities, with backdoor components communicating with C2 servers at 199.91.173.43/45 and decoy documents tied to Government of India assets; the analysis explores possible ties to the Pakistani firm Tranchulas and related individuals, and lays out multiple attribution hypotheses.