Loading malware…
ElizaRAT is a remote access trojan associated with the Pakistan-attributed espionage group Transparent Tribe (APT36, also known as ProjectM and Earth Karkaddan). The provided content states the group has been active since at least 2013 and has used ElizaRAT alongside other malware families including CapraRAT, Crimson RAT, and DeskRAT. Check Point’s 2024 analysis is cited as identifying ElizaRAT as a Transparent Tribe RAT used for data exfiltration. The malware is referenced in the context of spear-phishing campaigns targeting Indian military, diplomatic, governmental, academic, and strategic entities, including organizations such as Hindustan Aeronautics, the Indian Army, and the Indian Navy. Reported delivery methods used by Transparent Tribe in related campaigns include phishing emails with ZIP archives containing malicious LNK files disguised as PDF documents, use of mshta.exe to retrieve remote HTA loaders, in-memory payload execution, persistence tailored to detected antivirus products, and deployment of decoy documents. While the content does not provide ElizaRAT-specific technical internals or indicators of compromise, it consistently places ElizaRAT within Transparent Tribe’s espionage toolkit for remote access and theft of victim data.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Active since at least 2013, they’ve evolved tools like ElizaRAT, a remote access trojan for data exfiltration and ApoloStealer for credential theft, per Check Point’s 2024 analysis.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used by Transparent Tribe for persistence, surveillance, exfiltration, and remote command execution (capabilities described at the group level in the content).
A remote access trojan (RAT) used by Transparent Tribe (APT36) for persistent access and espionage operations.
Remote access trojan used for data exfiltration.
Remote Access Trojan (RAT) used by COPPER FIELDSTONE for espionage and remote control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.