Cisco Talos Transparent Tribe Education Campaign July 2022

Crimson can collect information from a compromised host.

Crimson can identify the user on a targeted system.

Crimson can exfiltrate stolen information over its C2.

Crimson can use a module to perform keylogging on compromised hosts.

Crimson contains a command to list processes.

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.

Crimson has the ability to delete files from a compromised host.

Crimson contains a command to collect the victim PC name and operating system.

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

Crimson contains a command to retrieve files from its C2 server.

Crimson contains a command to perform screen captures.

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.

During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.

During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.

For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.

Crimson contains a command to collect disk drive information.