Transparent Tribe APT36 launches attacks using spear-phishing emails with ZIP archives containing weaponized LNK files disguised as PDFs. The LNK file triggers remote HTA script execution via mshta.exe, which decrypts and loads RAT payloads directly into memory while displaying decoy PDF documents. The malware adapts persistence methods based on detected antivirus solutions (Kaspersky, Quick Heal, Avast, AVG, Avira). The RAT includes DLL 'iinneldc.dll' with capabilities for remote system control, file management, data exfiltration, screenshot capture, and clipboard manipulation. Additional campaign uses MSI installer 'nikmights.msi' that deploys executables and DLLs, establishes Registry-based persistence, and communicates with C2 infrastructure using reversed endpoint strings. Patchwork group linked to StreamSpy trojan using WebSocket and HTTP protocols for C2 communication.