APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal

Pakistan-nexus threat actor APT36 has launched a renewed espionage campaign targeting government and defense organizations in India and Afghanistan.

Deploying a new Rust-based malware suite designed for covert command-and-control, data theft, and propagation into isolated networks.

Tracked by Zscaler ThreatLabz as Operation RapidRust, the activity was observed in August 2026 and reflects a significant evolution in the group’s tooling.

The campaign introduces the RUSTYSHADE backdoor, RUSTYMOVE removable-media propagation utility, and PSNATCH and BASHNATCH file stealers for Windows and Linux systems.

Its latest operation continues the group’s use of trusted cloud platforms and masquerading infrastructure, while shifting more of its malware development toward Rust.

The central payload, RUSTYSHADE, is a 64-bit Windows backdoor written in Rust.

It communicates with attacker-controlled private GitHub repositories through the GitHub REST API, allowing operators to blend command-and-control traffic with legitimate developer-platform activity.

Unlike the previously documented Golang-based GITSHELLPAD backdoor, RUSTYSHADE encrypts its communications using AES-256-GCM.

The malware derives its encryption key from a SHA-256 hash of a hard-coded GitHub personal access token, generates a random 12-byte nonce, and formats encrypted data with an HCENC1: prefix before Base64 encoding it.

APT36 operators can issue commands through a command.txt file in a private repository, while the malware returns execution results through results.txt.

Additional repository files support victim profiling, heartbeats, screenshot capture, webcam collection, and encrypted file exfiltration.

RUSTYSHADE can execute shell commands, enumerate drives and directories, capture desktop screenshots, take webcam images, and compress and upload selected files.

This GitHub-based C2 approach builds on the group’s earlier GOGITTER and GITSHELLPAD activity, which also used private repositories to stage payloads and exchange commands.

In January 2026, Zscaler linked that earlier activity to campaigns against Indian government entities, although it assessed that operation could involve an APT36 subgroup or another Pakistan-linked cluster.

ThreatLabz said in a report shared with GBhackers, PSNATCH, a PowerShell-based information stealer that recursively searches Desktop, Downloads, Documents, OneDrive locations, and drives D: through H:.

The malware targets Office documents, archives, images, databases, scripts, executables, and media files modified during the previous 120 days.

APT36, also known as Transparent Tribe, has historically focused on Indian government, military, diplomatic, and defense-sector targets.

APT36 Malware Campaign

PSNATCH limits collection to 1 GB per file and 5 GB per run, then sends stolen data to private GitHub repositories using a hard-coded personal access token.

ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issues commands only between 4:00 a.m. and 11:00 a.m. UTC.

It creates a separate repository for each victim machine and tracks uploaded files locally through %APPDATA%\SmartUploader\uploaded_files.json, enabling incremental exfiltration rather than repeatedly transmitting the same data.

The Linux counterpart, BASHNATCH, follows a similar collection model and stores its upload-tracking data in ~/.local/share/SmartUploader/uploaded_files.json.

The inclusion of both Windows and Linux stealers indicates that the operators are pursuing intelligence across mixed enterprise and defense environments.

RUSTYMOVE is a lightweight Rust utility built to spread malware through removable storage.

It continuously detects USB, SD, MMC, and IEEE 1394-connected drives, then copies a ZIP archive containing RUSTYSHADE alongside a malicious .pdf.LNK shortcut to the root directory of each newly identified device.

The tool’s value lies in its potential to bridge segmented or air-gapped systems, a persistent concern for defense, government, and critical-infrastructure networks.

APT36 established persistence for RUSTYMOVE using a scheduled task named StandAloneOneDriveUpdater-2626, an attempt to resemble a legitimate OneDrive component.

Operators also performed extensive reconnaissance, including subnet sweeps, SMB and RPC port checks, network-share mapping, hostname resolution, and attempts to connect to remote IPC$ shares.

They used scheduled tasks impersonating Microsoft Edge and OneDrive updates, while deleting artifacts after deployment.

The campaign relied on domains impersonating major Indian news outlets, including theprints[.]org, spoofing ThePrint, and indiatodays[.]org, spoofing India Today.

These domains hosted intermediary PowerShell scripts and later-stage payloads, while Backblaze cloud storage supported malware delivery.

For defenders, high-priority hunting should focus on unexpected GitHub API activity from endpoints, GitHub personal access tokens embedded in binaries or scripts.

Scheduled tasks masquerading as update services, outbound communication to the identified typosquat domains, and removable media containing DriverInstaller.zip or PDF-named LNK files.

The campaign reinforces APT36’s shift toward resilient cloud-backed C2 and tooling that can sustain espionage operations across both connected and isolated environments.

Indicators Of Compromise

Type	Indicator
Payload staging domain	theprints[.]org
Payload staging domain	officialinfo[.]org
Payload staging domain	indiatodays[.]org
Payload staging URL	theprints.]org/adrive
Payload staging URL	theprints[.]org/drivefolder
Payload staging URL	theprints[.]org/mau

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC