APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
Zscaler ThreatLabz tracks the August 2026 activity as Operation RapidRust, introducing the Rust-based RUSTYSHADE backdoor, the RUSTYMOVE removable-media propagation utility, and PSNATCH and BASHNATCH file stealers for Windows and Linux. RUSTYSHADE uses private GitHub repositories as C2 with AES-256-GCM-encrypted traffic, supporting shell commands, screenshots, webcam capture, and encrypted exfiltration, while PSNATCH collects Office documents, archives, images, and databases from user folders and drives D: through H:. Typosquat domains spoofing ThePrint and India Today staged payloads with Backblaze storage, and persistence used scheduled tasks impersonating OneDrive and Microsoft Edge updates.
- RUSTYSHADE backdoor uses private GitHub repos as encrypted C2, supporting screenshots, webcam capture, and file exfiltration.
- RUSTYMOVE spreads via USB, SD, MMC, and IEEE 1394 devices to bridge air-gapped networks.
- PSNATCH and BASHNATCH stealers target Office documents, archives, images, and databases on Windows and Linux.
- Typosquat domains theprints[.]org and indiatodays[.]org plus Backblaze supported payload staging.
- Persistence used scheduled tasks impersonating OneDrive and Edge; C2 commands ran 04:00-11:00 UTC.
- ATT&CK
- T1091 Replication Through Removable MediaT1053.005 Scheduled TaskT1105 Ingress Tool TransferT1113 Screen CaptureT1567.002 Exfiltration to Cloud Storage
- Vendors
- Zscaler
- Threat actors
- APT36Transparent Tribe
- Organizations
- Zscaler ThreatLabzGitHubBackblazeThePrintIndia Today
- Countries
- IndiaAfghanistanPakistan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | indiatodays.org | outlets, including theprints[.]org , spoofing ThePrint, and indiatodays[.]org , spoofing India Today. These domains hosted intermediary |
| domain | officialinfo.org | yload staging domain theprints[.]org Payload staging domain officialinfo[.]org Payload staging domain indiatodays[.]org Payload staging |
| domain | theprints.org | domains impersonating major Indian news outlets, including theprints[.]org , spoofing ThePrint, and indiatodays[.]org , spoofing Ind |
From the original article
4 min read at gbhackers.com
Pakistan-nexus threat actor APT36 has launched a renewed espionage campaign targeting government and defense organizations in India and Afghanistan. Deploying a new Rust-based malware suite designed for covert command-and-control, data theft, and propagation into isolated networks. Tracked by Zscaler ThreatLabz as Operation RapidRust, the activity was observed in August 2026 and reflects a significant evolution […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.