Pakistan-linked cyber-espionage group targets Indian institutions

A Pak-linked cyber-espionage group has mounted a wave of intrusions targeting a wide range of institutions, striking ministries, defence contractors, critical infrastructure, diplomatic missions.

- ABHINANDAN MISHRA

A Pakistan-linked cyber-espionage group known as Transparent Tribe, or APT36, has mounted a fresh wave of intrusions against a wide range of Indian institutions, striking ministries, defence contractors, critical infrastructure, and diplomatic missions abroad.

The campaign, uncovered by multiple cybersecurity firms including CYFIRMA, CloudSEK, and Hunt.io, has been active through July and August 2025 and is described as one of the most expansive operations attributed to the group in recent years.

Investigators say the victims this time were not confined to defence alone but spanned central government ministries and departments where officials rely on the Bharat Operating System Solutions (BOSS) Linux platform, the Ministry of Defence and its aerospace and missile-linked contractors, the Ministry of External Affairs, Indian diplomatic posts overseas, and key sectors such as the railways and oil and gas operators.

Individual government employees who depend on Kavach, the mandatory two-factor authentication system that protects official accounts and emails, were also specifically targeted.