Operation_C-Major__2020__Transparent_Tribe_Evolution_analysis_part_2_Securelist.pdf

Kaspersky research documents Transparent Tribe’s continued targeted operations against Indian military and government personnel, describing new Android implants (trojanized video player and fake Aarogya Setu app) that deliver a modified AhMyth-based RAT with extensive data-stealing and audio-recording capabilities, associated Windows droppers (linked to ObliqueRAT and Crimson RAT), C2 infrastructure (including http://tryanotherhorse.com/config.txt -> 212.8.240.221:5987), and a set of IoCs for detection and response.