Threat video1:00
APT36 Crimson RAT and CapraRAT: Detection & IOCs
APT36 has spied on Indian targets since 2013 with Windows and Android RATs. 9 detection rules, 32 IOCs, 29 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for APT36 Crimson RAT and CapraRAT: Detection & IOCs →
Chapters
- 0:00The hookAPT36 targets India across two platforms
- 0:04The storySince 2013, APT36 targets Indian defense
- 0:11Attack pathSpearphishing emails spread malicious macro documents
- 0:27AttributionAttributed to APT36.
- 0:32Indicators of compromise29 indicators to hunt: 4 IPs, 5 domains and 1 port, and more.
- 0:38MITRE ATT&CK techniques29 ATT&CK techniques, from resource development to exfiltration.
- 0:44Remediation5 steps now: Block known Transparent Tribe C2 domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00APT36 targets India across two platforms
0:05Since 2013, APT36 targets Indian defense
0:09Then it expanded to schools
0:12Spearphishing emails spread malicious macro documents
0:15CrimsonRAT reconnaissance on Windows devices
0:19Trojanized apps install CapraRAT on Android
0:23Both persist and exfiltrate intelligence
0:28Attributed to APT36. Confidence: high.
0:3329 indicators to hunt: 4 IPs, 5 domains and 1 port, and more.
0:3929 ATT&CK techniques, from resource development to exfiltration.
0:445 steps now: Block known Transparent Tribe C2 domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.