For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.2
campaign
C0011 C0011
- First seen
- December 2021
- Last seen
- July 2022
- Created
- 22 September 2022
- Last modified
- 31 July 2026
C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from Transparent Tribe's historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.[1]
8
TechniquesBottom 21%
3
TacticsBottom 13%
1
Tool or malware45th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0011
During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.3
During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.4
During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.5
During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.6
For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.7
Standing C0011
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques8Bottom 21%
21st percentile · 79% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics3Bottom 13%
13th percentile · 87% of 56 ATT&CK campaigns have more tactics spanned.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique9.5medBottom 25%
25th percentile · 75% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique0.5med
Detection coverage C0011
159 distinct rules cover the 8 techniques recorded for this campaign. The 179 technique-to-rule mappings resolve to 159 distinct rules, because one rule can cover several techniques. 91 Sigma · 68 Splunk.
7 covered by at least one rule1 with no coverage159 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org