CrimsonRAT
CrimsonRAT is a Windows .NET remote access trojan used by Transparent Tribe (APT36), and the provided reporting describes it as malware known to be used only by that actor. It has been Transparent Tribe’s primary Windows implant since at least 2020 and is used to establish long-term access in victim networks. Reported delivery commonly relies on spear-phishing or phishing attacks using malicious Office documents with VBA macros that extract an embedded archive, unzip it, and execute the payload. Campaigns using CrimsonRAT have targeted Indian entities, including government, military, defense-related organizations, and educational institutions and students; broader reporting in the content also ties Transparent Tribe to targeting military, diplomatic, education, activist, rail, oil, and critical infrastructure sectors in the India-Pakistan context.
Capabilities directly described in the content include directory and drive listing, process listing, screenshot capture, file read/write/delete, arbitrary command execution, and exfiltration to command-and-control infrastructure. CrimsonRAT can also run or manage keylogger and USB-related modules and report their presence or versions to C2. The malware is associated with long-term espionage access and data theft. Reporting also notes overlaps in maldocs, macros, infrastructure, and operational patterns with other Transparent Tribe tooling, including ObliqueRAT and Android malware such as CapraRAT and AhMyth.
Infrastructure and indicators mentioned in the content include IP address 198.37.123[.]126, which was tied to Transparent Tribe spyware hosting and related domains such as phone-drive[.]online and phone-drive.online.geo-news[.]tv, and 173.249.50[.]243, which was tied to CrimsonRAT and AhMyth Android RAT C2 activity since at least 2022. Additional infrastructure overlap cited by Talos includes studentsportal[.]live, studentsportal[.]website, studentsportal[.]co, cloud-drive[.]store, user-onedrive[.]live, drive-phone[.]online, geo-news[.]tv and related subdomains, with recent resolution to 198.37.123[.]126. One report also notes a certificate common name WIN-P9NRMH5G6M8 as a longstanding indicator associated with Transparent Tribe’s CrimsonRAT servers. The content further places CrimsonRAT in Transparent Tribe’s tooling evolution, with continued Windows use alongside later Linux families such as Poseidon, AresRAT, and DeskRAT.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CrimsonRAT is Windows malware, known to be used only by Transparent Tribe.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Stealth
1 technique
Stealth
Command and Control
3 techniques
Command and Control
The sendData method is responsible for constructing the data collected by other methods and classes and sending it to the C2. The mRun method constructs the socket and sends the data to the C2 server using the variables specified in the Settings class.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan deployed by APT36 via sophisticated phishing attacks.
A Windows RAT used by APT36 in parallel with its Linux malware development and delivered through lure documents such as xlam, ppam, and docm files.
Windows remote access trojan associated with Transparent Tribe, referenced for shared versioning conventions and overlapping C2 infrastructure indicators.
A RAT associated in the report with Transparent Tribe infrastructure; specifically mentioned as sharing C2-linked IP infrastructure with CapraRAT activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.