Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale

Transparent Tribe (APT36) is moving from traditional, off‑the‑shelf tools to an AI-assisted malware model researchers now call “vibeware,” signaling how large language models are starting to industrialize mediocre but relentless attacks at scale.​

In its latest campaigns against Indian government bodies, embassies and regional targets, the group has shifted to an AI-driven development pipeline that produces a constant stream of disposable implants in multiple languages.

The goal is less about technical elegance and more about volume: a “malware-a-day” cadence designed to exhaust defenders rather than outsmart them.​

Researchers describe these new tools as vibeware: code that is syntactically correct but logically weak, often riddled with mistakes such as missing C2 URLs or broken state logic that renders components partially unusable.

Pakistan-based APT36, also known as Transparent Tribe, has historically relied on established frameworks such as Cobalt Strike, Havoc, and Gate Sentinel for post‑exploitation and command-and-control.

This pattern strongly aligns with LLM-generated code, which can rapidly remix existing samples but struggles with complex, end‑to‑end design.​

Transparent Tribe’s Vibeware

APT36’s fleet now spans niche languages like Nim, Zig and Crystal alongside Rust, Go, .NET and classic C-based components.

Samples such as Warcode (Crystal shellcode loader), NimShellcodeLoader, CrystalShell and ZigShell demonstrate rapid porting of similar logic across languages, a task made far easier by AI tools that translate code between ecosystems on demand.

This polyglot strategy helps reset detection baselines, because many EDR products still have weaker behavioral models and signatures for less common runtimes.​

At the same time, the group continues to fall back on mature frameworks by wrapping Cobalt Strike and Havoc beacons in these new loaders. When experimental vibeware fails, stable, human‑audited implants ensure the intrusion can continue.​

Rather than investing in bespoke infrastructure, APT36 is aggressively abusing what researchers call Living Off Trusted Services (LOTS) for command-and-control and exfiltration.

The campaign uses platforms like Google Sheets, Supabase, Firebase, Discord and Slack as covert C2 channels, hiding traffic inside legitimate HTTPS flows that many enterprises implicitly trust.​

A similar conclusion as the recent report from Google’s GTIG team, which noted that they have “not yet observed APT or information operations (IO) actors achieving breakthrough capabilities.

Other components such as SupaServ and LuminousStealer push data and tasking through Supabase, Firebase and Google Drive, while CrystalShell and ZigShell map directly to Discord and Slack bots using Base64-encoded commands and simple access controls.​

AI-Made Malware

Initial compromise still relies on familiar social engineering: phishing emails delivering archives with shortcut (.LNK) files or malicious PDFs that imitate resumes and lure victims to attacker-controlled download pages.

SheetCreep turns a Google spreadsheet into a bidirectional C2 hub, polling cells for Base64‑ and DES‑encrypted commands and writing back results via the Google Drive API.

Once a victim opens the shortcut, fileless PowerShell loaders fetch and execute backdoors in memory before operators pivot to manual post‑exploitation.​

Broad toolchain handles credential theft, lateral movement and bulk exfiltration. Components like MailCreep and LuminousStealer harvest files and Microsoft 365 data, while LuminousCookies injects into Chromium-based browsers to bypass new App‑Bound Encryption protections and steal cookies and passwords from inside the browser process.

Utility tools such as BackupSpy quietly catalog and stage sensitive documents from local and removable drives into centralized folders for later theft.​

ZigShell is a functional counterpart to CrystalShell but utilizes Slack as its primary C2 infrastructure and is written in Zig language.

Despite the AI hype, researchers see no leap in raw capability: most implants are generic, inconsistent and sometimes non-functional, echoing similar conclusions from other threat intelligence teams.

The real change is industrial: AI collapses the expertise required to generate large volumes of niche-language malware and to glue it into well-documented cloud APIs.

This allows actors like Transparent Tribe to flood environments with parallel implants using different languages and C2 channels, creating what analysts describe as a “Distributed Denial of Detection” that aims to overwhelm, not outsmart, modern defenses.​

For defenders, that means shifting focus from signatures and file formats to behavior monitoring for untrusted binaries in user-writable paths, abnormal PowerShell activity, and persistent outbound traffic to cloud collaboration platforms from unknown processes.

The rise of vibeware suggests that security teams now face an era of AI-assisted noise at industrial scale, where resilience depends less on catching every binary and more on making networks hostile to the manual operators hiding behind them.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.