Crimson

First seen

2016-01-01 00:00:00

Malware type

rat

Family

Malware family

Operating systems

windows

Related IoCs

39 (13 malicious)

Last IoC activity

2026-10-18 00:35:43

Profile updated

2026-07-07 15:46:39

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:in country_code:pk

Context

Crimson is a remote access Trojan that has been used by Transparent Tribe since at least 2016.

Recent IoC activity

13 malicious indicators in Maltiverse are attributed to Crimson (S0115). The 13 most recently updated:

Detection coverage

• 427 Sigma rules

Malware & tools used

• File and Directory Discovery (attack-pattern)
• Video Capture (attack-pattern)
• Security Software Discovery (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• File Deletion (attack-pattern)
• System Time Discovery (attack-pattern)
• System Information Discovery (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Time Based Checks (attack-pattern)
• Keylogging (attack-pattern)
• Web Protocols (attack-pattern)
• Data from Local System (attack-pattern)
• System Owner/User Discovery (attack-pattern)
• Screen Capture (attack-pattern)
• Audio Capture (attack-pattern)
• Exfiltration Over C2 Channel (attack-pattern)
• Process Discovery (attack-pattern)
• Local Email Collection (attack-pattern)
• Modify Registry (attack-pattern)
• System Network Configuration Discovery (attack-pattern)
• Peripheral Device Discovery (attack-pattern)
• Data from Removable Media (attack-pattern)
• Replication Through Removable Media (attack-pattern)
• System Location Discovery (attack-pattern)
• Ingress Tool Transfer (attack-pattern)

Used by threat actors

• C0011 (campaign)
• Transparent Tribe (threat-actor)

Related threat objects

• Crimson RAT (malware)

Reports & references

• proofpoint.com — Proofpoint Operation Transparent Tribe Threat Insight En (report)
• Kaspersky — 98127 (report)
• MITRE ATT&CK — S0115 (report)
• connect-trojan.net — Crimson Rat 3.0.0 (report)

External references

• mitre-attack — S0115
• MSIL/Crimson
• Kaspersky Transparent Tribe August 2020
• Proofpoint Operation Transparent Tribe March 2016
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy