ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 details ProjectM, a targeted campaign against Indian government and military personnel that reuses web infrastructure and leverages spear‑phishing and watering‑hole techniques to deliver a variety of Trojans (Crimson, Peppy, Andromeda, DarkComet, Bozok). Investigators link multiple C2 domains and payloads to an individual in Karachi via WHOIS records, reused hosting, social media/blog evidence and debug paths; the report includes domain/filename IOCs, SHA256 hashes and notes that ProjectM‑related C2 servers contained gigabytes of Indian military PII.