Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

Description

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor targeting Indian government and military entities. Their campaigns utilize ElizaRAT, a Windows Remote Access Tool that has evolved to enhance evasion techniques and C2 communication. Recent campaigns employ cloud services like Google Drive, Telegram, and Slack for distribution and control. The malware deploys payloads such as ApoloStealer to collect sensitive information from victims' systems. ElizaRAT's execution methods and detection evasion have improved, with new variants using different cloud services and VPS for C2. The campaigns exclusively target Indian systems, as evidenced by time zone checks in the malware.