Fake domains . Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Malicious file-sharing domains . Transparent Tribe also regularly registers domains that appear to be legitimate file- and media-sharing services. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe also delivers malicious archives containing CrimsonRAT executables using various themes, including honeytraps. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites. 55: How Transparent Tribe could e. Threat Source newsletter (May 27, 2021) Elizabethan England has nothing on modern-day Russia Vulnerability Spotlight: Multiple vulnerabilities . Threat Roundup for May 14 to May 21 Talos Takes Ep. 55: How Transparent Tribe could e. - Threat Source newsletter (May 27, 2021) - Elizabethan England has nothing on modern-day Russia - Vulnerability Spotlight: Multiple vulnerabilities . - Threat Roundup for May 14 to May 21 - Talos Takes Ep