Skip to content

Transparent Tribe

IntrusionSet · ATTACK:enterprise:G0134

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0134",
  "title": "Transparent Tribe",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0134",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--e44e0985-bc65-4a8f-b578-211c858128e3",
  "external_id": "G0134",
  "domain": "enterprise",
  "created": "2021-09-02T15:14:33.738Z",
  "modified": "2026-07-31T18:48:23.430Z",
  "version": "1.2",
  "aliases": [
    "Transparent Tribe",
    "COPPER FIELDSTONE",
    "APT36",
    "Mythic Leopard",
    "ProjectM"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Mythic Leopard"
    },
    {
      "source_name": "COPPER FIELDSTONE"
    },
    {
      "source_name": "APT36"
    },
    {
      "source_name": "ProjectM"
    },
    {
      "source_name": "Crowdstrike Mythic Leopard Profile",
      "url": "https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/"
    },
    {
      "source_name": "Kaspersky Transparent Tribe August 2020",
      "url": "https://securelist.com/transparent-tribe-part-1/98127/"
    },
    {
      "source_name": "Unit 42 ProjectM March 2016",
      "url": "https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
    },
    {
      "source_name": "Proofpoint Operation Transparent Tribe March 2016",
      "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
    },
    {
      "source_name": "Talos Transparent Tribe May 2021",
      "url": "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"
    },
    {
      "source_name": "Secureworks COPPER FIELDSTONE Profile",
      "url": "https://www.secureworks.com/research/threat-profiles/copper-fieldstone"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02fa0350-978f-4b61-b004-82380e70beee

Proofpoint Operation Transparent Tribe March 2016 · Unit 42 ProjectM March 2016 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0334

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--074ed0d8-8a95-4090-a23b-6c3915587590

Unit 42 ProjectM March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1608.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--087c222c-4108-4fbf-ac8f-983cd71548fa

Proofpoint Operation Transparent Tribe March 2016 · Unit 42 ProjectM March 2016 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e9e8c43-24f5-401f-8e50-5b4a476ea31d

Talos Oblique RAT March 2021 · Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13189e47-4ae9-49ea-8c0f-605177626ada

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020 · Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021 · Unit 42 ProjectM March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17087e76-4d84-443e-8fb1-0ec6498681db

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1568

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23041edc-3136-49b7-8d08-311321455aa7

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1584.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a27a98e-ee19-49f3-96e4-a5c9ee6e65ed

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0385

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ca333e2-c94f-4cc1-af46-beae48ff3c43

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--312f53be-d610-4c7c-af9b-44148c07bf7e

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4364b7ab-fd25-4145-84e6-e9e74ac3c0dd

Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d1b4d28-84c8-4ae4-9e04-c437dc391eac

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c9abd4f-d439-40ff-94fa-dd397d473942

Proofpoint Operation Transparent Tribe March 2016 · Talos Transparent Tribe May 2021

ATTACK:enterprise:C0011 → attributed-to → ATTACK:enterprise:G0134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--751e795e-7c1a-4ba1-bb20-636aed025df9

Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88f1dfcb-3b2a-494d-bab2-027602c4f78f

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9553062d-2207-4990-b9d4-a29f75628bd5

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c3c62d3-d97c-4478-b822-e7019861121d

Proofpoint Operation Transparent Tribe March 2016 · Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b43dfc0c-beca-45c0-bb47-5b57a6acada9

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020 · Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021 · Unit 42 ProjectM March 2016

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4824825-f732-44d9-a088-3ce222c0f751

Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0643

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7429670-16be-43bb-b13d-35056c4c968e

Unit 42 ProjectM March 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.