Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Zscaler attributes Operation RapidRust to Pakistan-aligned APT36, targeting Indian and Afghan government and defense entities with new Rust malware and GitHub-based C2.
Zscaler ThreatLabz attributes Operation RapidRust to Transparent Tribe (APT36/Earth Karkaddan), which targeted government and defense organizations in India and Afghanistan with four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The Rust-based RUSTYSHADE backdoor uses attacker-controlled private GitHub repositories via the REST API for encrypted bidirectional C2, supporting screenshots, webcam capture, file operations, and command execution. RUSTYMOVE propagates via USB drives, while PSNATCH (PowerShell/Windows) and BASHNATCH (bash/Linux) steal recently modified files up to 1 GB per file and 5 GB per execution, with typosquatted domains mimicking The Print and India Today hosting malicious scripts. Intensive operator activity was observed between August 20 and September 1, 2026, with C2 commands issued only on weekday mornings UTC.
- RUSTYSHADE backdoor communicates through private GitHub repos using files like command.txt and results.txt
- RUSTYMOVE stages RUSTYSHADE and a malicious LNK onto connected USB drives
- PSNATCH (Windows) and BASHNATCH (Linux) exfiltrate recently modified documents to private repositories
- Typosquatted domains impersonating The Print and India Today host malicious PowerShell payloads
- APT36 restricted C2 activity to weekdays between 4 a.m. and 11 a.m. UTC
- ATT&CK
- T1566.002 Spearphishing LinkT1102.002 Bidirectional CommunicationT1091 Replication Through Removable MediaT1005 Data from Local SystemT1113 Screen Capture
- Vendors
- Zscaler
- Threat actors
- Transparent TribeAPT36Earth Karkaddan
- Countries
- IndiaAfghanistan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | indiatoday.in | eprint[.]in") indiatodays[.]org, which mimics India Today ("indiatoday[.]in") Among the four newly identified malware families, one i |
| domain | indiatodays.org | - theprints[.]org, which mimics The Print ("theprint[.]in") indiatodays[.]org, which mimics India Today ("indiatoday[.]in") Among the f |
| domain | theprint.in | ts and payloads - theprints[.]org, which mimics The Print ("theprint[.]in") indiatodays[.]org, which mimics India Today ("indiatoda |
| domain | theprints.org | a Today to host malicious PowerShell scripts and payloads - theprints[.]org, which mimics The Print ("theprint[.]in") indiatodays[.]o |
From the original article
3 min read at thehackernews.com
The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.