The suspected Pakistan-linked threat actor known as Transparent Tribe is using malicious Android apps mimicking YouTube to distribute the CapraRAT mobile remote access trojan (RAT), demonstrating the continued evolution of the activity.
"CapraRAT is a highly invasive tool that gives the attacker control over much of the data on the Android devices that it infects," SentinelOne security researcher Alex Delamotte said in a Monday analysis.
Transparent Tribe, also known as APT36, is known to target Indian entities for intelligence-gathering purposes, relying on an arsenal of tools capable of infiltrating Windows, Linux, and Android systems.
A crucial component of its toolset is CapraRAT, which has been propagated in the form of trojanized secure messaging and calling apps branded as MeetsApp and MeetUp. These weaponized apps are distributed using social engineering lures.
The latest set of Android package (APK) files discovered by SentinelOne are engineered to masquerade as YouTube, one of which reaches out to a YouTube channel belonging to "Piya Sharma."
The app is named after its namesake, indicating that the adversary is using romance-based phishing techniques to entice targets into installing the applications. The list of apps is as follows -
- com.Base.media.service
- com.moves.media.tubes
- com.videos.watchs.share
Once installed, the apps request intrusive permissions that allow the malware to harvest a wide range of sensitive data and exfiltrate it to an actor-controlled server. CapraRAT is also capable of initiating phone calls as well as intercepting and blocking incoming SMS messages.
"Transparent Tribe is a perennial actor with reliable habits," Delamotte said. "The relatively low operational security bar enables swift identification of their tools. Individuals and organizations connected to diplomatic, military, or activist matters in the India and Pakistan regions should evaluate defense against this actor and threat."
