LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0115: Crimson

Crimson is a remote access Trojan that has been used by Transparent Tribe since at least 2016.[1][2]

EnterpriseS0115MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Crimson is a Windows remote access Trojan in ATT&CK associated with Transparent Tribe reporting. Its ATT&CK relationships show a broad post-compromise profile: discovery of users, processes, registry, files, network settings, peripherals and time; collection from local systems, removable media, email, keystrokes, screen, audio and video; command execution; C2 over web and non-application protocols; ingress tool transfer; registry modification; file deletion; removable-media replication; and exfiltration over C2. For leaders, the practical issue is not just “malware detection,” but whether Windows endpoint, network, removable-media, and sensitive-data monitoring can prove what was accessed and what may have left the environment.

Executive priority

Prioritize Crimson as a validation case for Windows endpoint resilience, data-loss visibility, and incident response readiness. The behavior set touches confidentiality-heavy assets such as local files, email stores, credentials entered by users, screenshots, audio/video, and removable media. Executives should ask whether the organization can rapidly answer: which hosts were affected, what data sources were queried or collected, whether C2/exfiltration occurred, whether removable media was involved, and whether registry or file-deletion activity impaired evidence. This is especially relevant for organizations with diplomatic, defense, research, or similar sensitive missions, based on the supplied Transparent Tribe targeting context.

Technical view

ATT&CK does not provide a detection section for Crimson, so SOC and IR teams should validate coverage through its related techniques rather than a single signature. On Windows, confirm visibility for command shell execution, registry query/modify activity, process and system discovery, file and directory enumeration, local email file access, removable-media access, keylogging-like input capture indicators where available, screen/audio/video capture API or process behavior, file deletion, tool transfer, and outbound C2/exfiltration over web or other protocols. Relationship-driven detections should correlate discovery followed by collection and outbound communications rather than relying only on malware name matches.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially cmd.exe and discovery utilities
  • Windows Registry query and modification events
  • File system access, enumeration, creation, deletion, and staging activity
  • Removable media insertion, file access, and execution telemetry
  • Local email data file access telemetry, such as Outlook cache or storage file access where collected

Detection direction

  • Build detections around behavior chains: discovery commands or API activity followed by file/email/removable-media collection and outbound communications.
  • Tune Windows command-shell detections to reduce administrative false positives by baselining common IT scripts, software inventory tools, and helpdesk activity.
  • Monitor Registry query and modification activity in context; many registry reads are normal, but suspicious value changes combined with execution or persistence-like behavior should be escalated.
  • Validate visibility into removable media because Crimson’s related techniques include both collection from and replication through removable media; this is a common blind spot in endpoint-only programs.
  • Correlate C2 and exfiltration possibilities across web protocols and non-application-layer protocols; proxy-only monitoring may miss some communications.

Mitigation priorities

  • Harden Windows endpoints with least privilege, endpoint protection, controlled script/command execution, and monitoring of administrative utilities.
  • Restrict and monitor removable media use, especially in sensitive or segmented environments.
  • Limit unnecessary local storage of sensitive files and email caches; apply data handling controls where business processes allow.
  • Use network egress controls and logging for web and non-standard protocols, with alerting for unusual destinations or transfer patterns.
  • Apply application control or allowlisting where feasible to reduce unauthorized tool transfer and execution.
Additional notes and limits

The supplied ATT&CK object identifies Crimson as a Windows remote access Trojan used by Transparent Tribe since at least 2016, with external references from Proofpoint and Kaspersky. ATT&CK provides no official detection text for the malware, so this take derives defensive priorities from the supplied technique relationships and Windows platform field. The related Transparent Tribe description provides sector and geography context for intelligence scoping, not a basis to claim current targeting or exposure.

This assessment is limited to the supplied ATT&CK STIX fields, references, and relationships. It does not include indicators of compromise, malware configuration details, C2 infrastructure, prevalence, current campaign activity, or validated detection logic. Local environment telemetry, asset criticality, endpoint tooling, network architecture, and data-handling practices are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Crimson

Crimson is a remote access Trojan that has been used by Transparent Tribe since at least 2016.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

30 rows
DomainIDNameRelationship / procedure
EnterpriseT1083File and Directory Discovery

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.[1][2][3]

EnterpriseT1125Video Capture

Crimson can capture webcam video on targeted systems.[1][2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Crimson contains a command to collect information about anti-virus software on the victim.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Crimson can add Registry run keys for persistence.[1][2]

EnterpriseT1070.004File DeletionSub-technique

Crimson has the ability to delete files from a compromised host.[1][2][3]

EnterpriseT1124System Time Discovery

Crimson has the ability to determine the date and time on a compromised host.[2]

EnterpriseT1082System Information Discovery

Crimson contains a command to collect the victim PC name and operating system.[1][2][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

Crimson can decode its encoded PE file prior to execution.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.[1]

EnterpriseT1056.001KeyloggingSub-technique

Crimson can use a module to perform keylogging on compromised hosts.[1][2][3]

EnterpriseT1071.001Web ProtocolsSub-technique

Crimson can use a HTTP GET request to download its final payload.[1]

EnterpriseT1005Data from Local System

Crimson can collect information from a compromised host.[3]

EnterpriseT1033System Owner/User Discovery

Crimson can identify the user on a targeted system.[1][2][3]

EnterpriseT1113Screen Capture

Crimson contains a command to perform screen captures.[1][2][3]

EnterpriseT1123Audio Capture

Crimson can perform audio surveillance using microphones.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Crimson can exfiltrate stolen information over its C2.[3]

EnterpriseT1057Process Discovery

Crimson contains a command to list processes.[1][2][3]

EnterpriseT1114.001Local Email CollectionSub-technique

Crimson contains a command to collect and exfiltrate emails from Outlook.[1]

EnterpriseT1112Modify Registry

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.[1]

EnterpriseT1016System Network Configuration Discovery

Crimson contains a command to collect the victim MAC address and LAN IP.[1][2]

EnterpriseT1120Peripheral Device Discovery

Crimson has the ability to discover pluggable/removable drives to extract files from.[1][2]

EnterpriseT1025Data from Removable Media

Crimson contains a module to collect data from removable drives.[1][2]

EnterpriseT1091Replication Through Removable Media

Crimson can spread across systems by infecting removable media.[2]

EnterpriseT1614System Location Discovery

Crimson can identify the geographical location of a victim host.[2]

EnterpriseT1105Ingress Tool Transfer

Crimson contains a command to retrieve files from its C2 server.[1][2][3]

EnterpriseT1059.003Windows Command ShellSub-technique

Crimson has the ability to execute commands with the COMSPEC environment variable.[2]

EnterpriseT1095Non-Application Layer Protocol

Crimson uses a custom TCP protocol for C2.[1][2]

EnterpriseT1012Query Registry

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Crimson contains a module to steal credentials from Web browsers on the victim machine.[1][2]

EnterpriseT1680Local Storage Discovery

Crimson contains a command to collect disk drive information.[1][2][3]

Associated objects

Groups, software, and campaigns

CampaignEnterprise

C0011: C0011

C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from Transparent Tribe's historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1114.001: Local Email CollectionEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1025: Data from Removable MediaEnterpriseuses · GroupG0134: Transparent TribeEnterpriseuses · TechniqueT1091: Replication Through Removable MediaEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
d9a111ce51d1385d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundled9a111ce51d1…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  2. [2]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  3. [3]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  4. [4]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  5. [5]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  6. [6]
    MSIL/Crimson

    (Citation: Proofpoint Operation Transparent Tribe March 2016)

  7. [7]
    MSIL/Crimson

    (Citation: Proofpoint Operation Transparent Tribe March 2016)

  8. [8]
    MSIL/Crimson

    (Citation: Proofpoint Operation Transparent Tribe March 2016)

  9. [9]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  10. [10]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  11. [11]
    mitre-attackS0115
    Open source URL
  12. [12]
    mitre-attackS0115
    Open source URL
  13. [13]
    mitre-attackS0115
    Open source URL
  14. [14]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  15. [15]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  16. [16]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  17. [17]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  18. [18]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  19. [19]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  20. [20]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  21. [21]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  22. [22]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  23. [23]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  24. [24]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  25. [25]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  26. [26]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  27. [27]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  28. [28]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  29. [29]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  30. [30]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  31. [31]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  32. [32]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  33. [33]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  34. [34]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  35. [35]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  36. [36]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  37. [37]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  38. [38]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  39. [39]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  40. [40]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  41. [41]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  42. [42]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  43. [43]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  44. [44]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  45. [45]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  46. [46]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  47. [47]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  48. [48]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  49. [49]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  50. [50]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  51. [51]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  52. [52]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  53. [53]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  54. [54]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  55. [55]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  56. [56]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  57. [57]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  58. [58]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  59. [59]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  60. [60]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  61. [61]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  62. [62]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  63. [63]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  64. [64]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  65. [65]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  66. [66]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  67. [67]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  68. [68]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  69. [69]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  70. [70]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  71. [71]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  72. [72]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  73. [73]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  74. [74]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  75. [75]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  76. [76]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  77. [77]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  78. [78]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  79. [79]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  80. [80]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  81. [81]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  82. [82]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  83. [83]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  84. [84]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  85. [85]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  86. [86]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  87. [87]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  88. [88]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  89. [89]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  90. [90]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  91. [91]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  92. [92]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  93. [93]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  94. [94]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  95. [95]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  96. [96]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  97. [97]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  98. [98]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  99. [99]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  100. [100]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  101. [101]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  102. [102]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  103. [103]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  104. [104]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  105. [105]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  106. [106]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  107. [107]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  108. [108]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  109. [109]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  110. [110]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  111. [111]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  112. [112]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  113. [113]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  114. [114]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  115. [115]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  116. [116]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  117. [117]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  118. [118]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  119. [119]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  120. [120]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  121. [121]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  122. [122]
    Cisco Talos Transparent Tribe Education Campaign July 2022

    N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.

    Open source URL
  123. [123]
    Kaspersky Transparent Tribe August 2020

    Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.

    Open source URL
  124. [124]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use