Operation Transparent Title

Proofpoint researchers describe Operation Transparent Tribe, an APT campaign targeting Indian diplomatic and military personnel that used spearphishing and watering-hole sites to deliver weaponized RTF/Office documents (CVE-2012-0158) which decode and execute an embedded PE to install a modular RAT family dubbed MSIL/Crimson; the report includes technical analysis of the downloader/RAT modules (keylogging, credential theft, USB exfiltration, remote control), linked malware (njRAT, Luminosity Link, DarkComet, Python/Peppy, Andromeda/Bezigate), cluster analysis tying campaigns to shared C2 infrastructure, and a comprehensive set of indicators of compromise (hashes, domains, and IPs) for detection and mitigation.