Archive · 5 Jan 2026
Pakistan-Aligned Hackers Target Indian Government and Universities
There's a group of hackers called APT36, also known as Transparent Tribe, who are from Pakistan.
They have been sending tricky emails to important places in India like government offices and universities.
These emails have secret bad software inside that can take control of computers, steal important information, and watch what people are doing.
The hackers can even take pictures of the computer screen and copy things from the clipboard.
They have been doing this since 2013 and have also targeted places in Afghanistan and about 30 other countries.
A company that studies cybersecurity, called Cyfirma, found out about this and warned everyone.
Pakistan-aligned hacker group APT36 targets Indian government and universities in a cyber espionage campaign.
The attack begins with spear-phishing emails containing malicious ZIP archives disguised as PDFs.
The malware, named ReadOnly and WriteOnly, can remotely control infected machines and steal sensitive data.
APT36 has been active since 2013 and has targeted institutions in India, Afghanistan, and approximately 30 other countries.
Cybersecurity firm Cyfirma has uncovered the modus operandi of these cyber spies and issued a warning.
- Who
- APT36 (Transparent Tribe), a Pakistan-aligned hacker group
- What
- A cyber espionage campaign targeting Indian government and academic institutions
- When
- The campaign has been ongoing, with APT36 active since 2013
- Where
- India, Afghanistan, and approximately 30 other countries
- Why
- To procure sensitive information and conduct persistent surveillance
- Hacker Group
- APT36 (Transparent Tribe)
- Targeted Entities
- Indian government, universities, strategic institutions
- Malware Used
- ReadOnly, WriteOnly
- Initial Attack Vector
- Spear-phishing emails with malicious ZIP archives
- Cybersecurity Firm
- Cyfirma
- Countries Affected
- India, Afghanistan, and approximately 30 others
- Active Since
- 2013